| Summary: | Firefox 45.7 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | jim, lewyssmith, sysadmin-bugs, wrw105 |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://lwn.net/Vulnerabilities/712491/ | ||
| Whiteboard: | has_procedure MGA5-32-OK MGA5-64-OK advisory | ||
| Source RPM: | firefox | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-01-25 01:54:51 CET
Tested mga5-64 Plugins: Java & flash (Twisted little flash game) Jetstream for javascript, acid 3 for general use, youtube for html5 video, and general browsing, all OK CC:
(none) =>
wrw105 RedHat has issued an advisory for this today (January 25): https://rhn.redhat.com/errata/RHSA-2017-0190.html Advisory: ================ Updated firefox packages fix security vulnerabilities: Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5386, CVE-2017-5390, CVE-2017-5396). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5373 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5375 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5376 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5378 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5380 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5383 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5386 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5390 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5396 https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/ https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ https://rhn.redhat.com/errata/RHSA-2017-0190.html On mga5-32 Packages installed: $ rpm -qa | grep firefox firefox-en_GB-45.7.0-1.mga5 firefox-45.7.0-1.mga5 Packages installed cleanly. Java, flash, html5 all OK No regressions noted. OK for mga5-32 CC:
(none) =>
jim On mga5-64 Packages installed: - firefox-45.7.0-1.mga5.x86_64 - firefox-en_GB-45.7.0-1.mga5.noarch Packages installed cleanly. Java, flash, html5 all OK No regressions noted. OK for mga5-64 James, thanks for testing. Please post the OK's to the whiteboard when you do. URL:
(none) =>
https://lwn.net/Vulnerabilities/712491/ I thought that we usually wanted more than one test on each arch for important applications like Firefox. I must have mis-remembered. (In reply to James Kerr from comment #6) > I thought that we usually wanted more than one test on each arch for > important applications like Firefox. I must have mis-remembered. On the contrary, highly critical ones that are usually trivial to test, that we need to get out in a timely manner, you need to not be afraid to OK and validate. The ones where we want multiple testers mostly tend to be highly hardware-dependent ones like the kernel or some drivers, or where many different configurations need to be tested and have been volatile in the past like virtualbox. Validated. Advisory from comments 0 & 2. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0023.html Status:
NEW =>
RESOLVED |