Re: CVE-2023-5217 unimportant for firefox?
On Sat, 30 Sep 2023 17:28:29 +0200 Klaus Singvogel <deb-user-ml@singvogel.net> wrote:
> hede wrote:
> > Hi,
> >
> > does anyone know why CVE-2023-5217 (critical vp8 encoder bug) is rated as an "open unimportant issue" for firefox-esr? Currently it is not fixed in bookworm and newer [1]. Mozilla itself rates it as "critical" [2].
>
> That's fixed in Debian Bullseye.
> If I look into /usr/share/doc/firefox-esr/changelog.Debian.gz, I find this entry on top:
>
> ---------------------------------------------------------------------
> firefox-esr (115.3.1esr-1~deb11u1) bullseye-security; urgency=medium
>
> * New upstream release.
> * Fix for mfsa2023-44, also known as CVE-2023-5217.
> ---------------------------------------------------------------------
Yeah, fixed in Bullseye and not in Bookworm and newer, that's what I criticised.
But the Wanderer and Lee already had an explanation: Firefox in Bookworm and newer uses the system library (libvpx) which has fixes applied.
hede
Reply to: