Re: [SECURITY] [DSA 5113-1] firefox-esr security update
On 14.04.22 14:52, Elmar Stellnberger wrote:
I am also running Debian 10 on my Asus eeePC (Pentium M). I
am mainly using it as a dictionary. Although I am performing
security updates quite regularly I have not run into this
issue. Having updated just now I am with Firefox
78.15.0-esr-1~deb10u1 and with
** gcc 4:8.3.0-1 being offered by
I have looked at the build log of QCoan in the OBS and it is using
gcc-8-8.3.0-6. That is even newer than what got installed by the
updates. I would thus believe that the gcc bug is still there that
prevents some Firefox version from building, but that I simply have not
noticed this issue via the normal upgrade process.
Another explanation would of course be that the two errors are unrelated.
> Where can I get this from for buster and architecture i386?
>
<http://security.debian.org/debian-security/dists/buster/updates/main/binary-i386/Packages.xz>
> does not have it.
Friedhelm, how have you taken notice about this issue?
Was the file really not there or do you think you have forgotten to type
firefox-esr instead of firefox or something the like?
> Package : firefox-esr
> CVE ID : CVE-2022-1097 CVE-2022-1196 CVE-2022-24713
CVE-2022-28281
> CVE-2022-28282 CVE-2022-28285 CVE-2022-28286
CVE-2022-28289
>
> Multiple security issues have been found in the Mozilla Firefox web
> browser, which could potentially result in the execution of arbitrary
> code, information disclosure or spoofing.
>
> For the oldstable distribution (buster), these problems have been fixed
> in version 91.8.0esr-1~deb10u1.
>
> For the stable distribution (bullseye), these problems have been fixed in
> version 91.8.0esr-1~deb11u1.
>
> We recommend that you upgrade your firefox-esr packages.
At me it apparently has really kept an old unfixed version.
The message says fixed for oldstable, not mentioning that the fix has
not yet been achieved for i386 and that it was only applied to amd64.
Reply to: