[gentoo-announce] [ GLSA 201903-04 ] Mozilla Firefox: Multiple vulnerabilities - gentoo-announce

From:	Aaron Bauman <bman@g.o>
To:	gentoo-announce@l.g.o
Subject:	[gentoo-announce] [ GLSA 201903-04 ] Mozilla Firefox: Multiple vulnerabilities
Date:	Sun, 10 Mar 2019 19:55:50
Message-Id:	`20190310195041.GB14176@monkey`

1

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

2

Gentoo Linux Security Advisory                           GLSA 201903-04

3

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

4

                                           https://security.gentoo.org/

5

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

6

7

 Severity: Normal

8

    Title: Mozilla Firefox: Multiple vulnerabilities

9

     Date: March 10, 2019

10

     Bugs: #672956, #676892, #677856

11

       ID: 201903-04

12

13

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

14

15

Synopsis

16

========

17

18

Multiple vulnerabilities have been found in Mozilla Firefox, the worst

19

of which may allow execution of arbitrary code.

20

21

Background

22

==========

23

24

Mozilla Firefox is a popular open-source web browser from the Mozilla

25

Project.

26

27

Affected packages

28

=================

29

30

    -------------------------------------------------------------------

31

     Package              /     Vulnerable     /            Unaffected

32

    -------------------------------------------------------------------

33

  1  www-client/firefox           < 60.5.1                  >= 60.5.1 

34

  2  www-client/firefox-bin       < 60.5.1                  >= 60.5.1 

35

    -------------------------------------------------------------------

36

     2 affected packages

37

38

Description

39

===========

40

41

Multiple vulnerabilities have been discovered in Mozilla Firefox.

42

Please review the CVE identifiers referenced below for details.

43

44

Impact

45

======

46

47

A remote attacker could entice a user to view a specially crafted web

48

page possibly resulting in the execution of arbitrary code with the

49

privileges of the process or cause a Denial of Service condition.

50

51

Workaround

52

==========

53

54

There is no known workaround at this time.

55

56

Resolution

57

==========

58

59

All Mozilla FireFox users should upgrade to the latest version:

60

61

  # emerge --sync

62

  # emerge --ask --oneshot --verbose ">=www-client/firefox-60.5.1"

63

64

All Mozilla FireFox bin users should upgrade to the latest version:

65

66

  # emerge --sync

67

  # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-60.5.1"

68

69

References

70

==========

71

72

[  1 ] CVE-2018-12405

73

       https://nvd.nist.gov/vuln/detail/CVE-2018-12405

74

[  2 ] CVE-2018-18356

75

       https://nvd.nist.gov/vuln/detail/CVE-2018-18356

76

[  3 ] CVE-2018-18492

77

       https://nvd.nist.gov/vuln/detail/CVE-2018-18492

78

[  4 ] CVE-2018-18493

79

       https://nvd.nist.gov/vuln/detail/CVE-2018-18493

80

[  5 ] CVE-2018-18494

81

       https://nvd.nist.gov/vuln/detail/CVE-2018-18494

82

[  6 ] CVE-2018-18498

83

       https://nvd.nist.gov/vuln/detail/CVE-2018-18498

84

[  7 ] CVE-2018-18500

85

       https://nvd.nist.gov/vuln/detail/CVE-2018-18500

86

[  8 ] CVE-2018-18501

87

       https://nvd.nist.gov/vuln/detail/CVE-2018-18501

88

[  9 ] CVE-2018-18505

89

       https://nvd.nist.gov/vuln/detail/CVE-2018-18505

90

[ 10 ] CVE-2019-5785

91

       https://nvd.nist.gov/vuln/detail/CVE-2019-5785

92

93

Availability

94

============

95

96

This GLSA and any updates to it are available for viewing at

97

the Gentoo Security Website:

98

99

 https://security.gentoo.org/glsa/201903-04

100

101

Concerns?

102

=========

103

104

Security is a primary focus of Gentoo Linux and ensuring the

105

confidentiality and security of our users' machines is of utmost

106

importance to us. Any security concerns should be addressed to

107

security@g.o or alternatively, you may file a bug at

108

https://bugs.gentoo.org.

109

110

License

111

=======

112

113

Copyright 2019 Gentoo Foundation, Inc; referenced text

114

belongs to its owner(s).

115

116

The contents of this document are licensed under the

117

Creative Commons - Attribution / Share Alike license.

118

119

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Archives: gentoo-announce

Attachments

1	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2	Gentoo Linux Security Advisory GLSA 201903-04
3	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4	https://security.gentoo.org/
5	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7	Severity: Normal
8	Title: Mozilla Firefox: Multiple vulnerabilities
9	Date: March 10, 2019
10	Bugs: #672956, #676892, #677856
11	ID: 201903-04
12
13	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15	Synopsis
16	========
17
18	Multiple vulnerabilities have been found in Mozilla Firefox, the worst
19	of which may allow execution of arbitrary code.
20
21	Background
22	==========
23
24	Mozilla Firefox is a popular open-source web browser from the Mozilla
25	Project.
26
27	Affected packages
28	=================
29
30	-------------------------------------------------------------------
31	Package / Vulnerable / Unaffected
32	-------------------------------------------------------------------
33	1 www-client/firefox < 60.5.1 >= 60.5.1
34	2 www-client/firefox-bin < 60.5.1 >= 60.5.1
35	-------------------------------------------------------------------
36	2 affected packages
37
38	Description
39	===========
40
41	Multiple vulnerabilities have been discovered in Mozilla Firefox.
42	Please review the CVE identifiers referenced below for details.
43
44	Impact
45	======
46
47	A remote attacker could entice a user to view a specially crafted web
48	page possibly resulting in the execution of arbitrary code with the
49	privileges of the process or cause a Denial of Service condition.
50
51	Workaround
52	==========
53
54	There is no known workaround at this time.
55
56	Resolution
57	==========
58
59	All Mozilla FireFox users should upgrade to the latest version:
60
61	# emerge --sync
62	# emerge --ask --oneshot --verbose ">=www-client/firefox-60.5.1"
63
64	All Mozilla FireFox bin users should upgrade to the latest version:
65
66	# emerge --sync
67	# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-60.5.1"
68
69	References
70	==========
71
72	[ 1 ] CVE-2018-12405
73	https://nvd.nist.gov/vuln/detail/CVE-2018-12405
74	[ 2 ] CVE-2018-18356
75	https://nvd.nist.gov/vuln/detail/CVE-2018-18356
76	[ 3 ] CVE-2018-18492
77	https://nvd.nist.gov/vuln/detail/CVE-2018-18492
78	[ 4 ] CVE-2018-18493
79	https://nvd.nist.gov/vuln/detail/CVE-2018-18493
80	[ 5 ] CVE-2018-18494
81	https://nvd.nist.gov/vuln/detail/CVE-2018-18494
82	[ 6 ] CVE-2018-18498
83	https://nvd.nist.gov/vuln/detail/CVE-2018-18498
84	[ 7 ] CVE-2018-18500
85	https://nvd.nist.gov/vuln/detail/CVE-2018-18500
86	[ 8 ] CVE-2018-18501
87	https://nvd.nist.gov/vuln/detail/CVE-2018-18501
88	[ 9 ] CVE-2018-18505
89	https://nvd.nist.gov/vuln/detail/CVE-2018-18505
90	[ 10 ] CVE-2019-5785
91	https://nvd.nist.gov/vuln/detail/CVE-2019-5785
92
93	Availability
94	============
95
96	This GLSA and any updates to it are available for viewing at
97	the Gentoo Security Website:
98
99	https://security.gentoo.org/glsa/201903-04
100
101	Concerns?
102	=========
103
104	Security is a primary focus of Gentoo Linux and ensuring the
105	confidentiality and security of our users' machines is of utmost
106	importance to us. Any security concerns should be addressed to
107	security@g.o or alternatively, you may file a bug at
108	https://bugs.gentoo.org.
109
110	License
111	=======
112
113	Copyright 2019 Gentoo Foundation, Inc; referenced text
114	belongs to its owner(s).
115
116	The contents of this document are licensed under the
117	Creative Commons - Attribution / Share Alike license.
118
119	https://creativecommons.org/licenses/by-sa/2.5