bugtraq - [SECURITY] [DSA 4479-1] firefox-esr security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20190711205614.3anva5hk5u75ip4j@seger.debian.org>
Date: Thu, 11 Jul 2019 20:56:14 +0000
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 4479-1] firefox-esr security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-4479-1                   security@...ian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
July 11, 2019                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : firefox-esr
CVE ID         : CVE-2019-9811 CVE-2019-11709 CVE-2019-11711 CVE-2019-11712 
                 CVE-2019-11713 CVE-2019-11715 CVE-2019-11717 CVE-2019-11730
                 CVE-2019-11719 CVE-2019-11729

Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code, cross-site scripting, spoofing, information disclosure, denial of
service or cross-site request forgery.


For the oldstable distribution (stretch), these problems have been fixed
in version 60.8.0esr-1~deb9u1.

For the stable distribution (buster), these problems have been fixed in
version 60.8.0esr-1~deb10u1.

CVE-2019-11719 and CVE-2019-11729 are only addressed for stretch, in
buster Firefox uses the system-wide copy of NSS which will be updated
separately.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl0noDwACgkQEMKTtsN8
TjbLRA//cEymXG0jRo2p08DcuBusA2UlGZWtq7tHUHgkhsy6xjIoH6v2YDv/A4oK
jm9FZzGH6wv18eMv2x3LNuRsd2rsz3onK8/cCKhzv8SOSnQxxLA9u/MdH9x92ITX
JQY3huO7jOjz5WfR1Bb1azY60sXFcNQBgbF2EW0pCAZ5ApLBzetxOyiN+yqU8Vl1
aQwdtT7xuH0z3uhkgqMc4slc4IWxNPoLqkVAFvB017W3zaDD+pVWZlG1V2lHU8XB
wcFDEzDzlvQnqys2w2VCX0ZHPixwa/ZeYDrQSlUHTXWFchW2TPDR9HDBgEL6riTa
GwQM3OmbnbEJDAwKdSbDZ+Z1vDlpEuFDwyPA9IepTx0ge7qU2eVgT1lWUJrHdMyX
bDq9Vmqd8C8XG8q/d/u12WIV5XYOsyjQXqVSclbth7dwTz+PKdK19PfJXcx7JRie
t7R/QcMF/lFG0tL+vf9N457g/A5vQ83WaEUaUNsQvJKvkIUriEjCLrzzQqwzZB7l
e17ZVG1vwqaeOBUBlRzu9bSPY8NcbCg8KDVlyv1L4vEcyPSi3fGN6HwCf2lDn2uP
kF2oK1Bleifj7cJAGg9MRo2S7php9brk59fs/FpBmTm3VEykZPoh2eFzW/U+L7EX
+cp/1dGXbNeDiwxZMRdBJ5cI6OT6wsi8Mao9CdJ6XWn3iJnVVhw=
=agp1
-----END PGP SIGNATURE-----