SCIENTIFIC-LINUX-ERRATA Archives

October 2018

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Re: Security ERRATA Critical: firefox on SL6.x i386/x86_64
From:
Scott Reid <[log in to unmask]>
Reply To:
Scott Reid <[log in to unmask]>
Date:
Tue, 9 Oct 2018 17:01:12 +0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (1 lines) 



Hi Andrei,





The Security updates for SLF go out the week following the SL updates. This particular update should be available next Tuesday. The debuginfo repo is shared between SL and SLF, so you may see the debuginfo before the security update is available.





Thanks!





On 10/9/18, 11:23 AM, "Andrei Gaponenko" <[log in to unmask]> wrote:





    Hello,


    


    On an SLF6 system I see an updated debuginfo, but still not the main


    firefox package.  Did something go wrong, or should I just wait longer?


    


    mu2epix01 ~$ yum clean all


    Loaded plugins: priorities, protectbase, refresh-packagekit, security


    Cleaning repos: epel osg slf slf-security slf6x slf6x-security


    Cleaning up Everything


    


    mu2epix01 ~$ yum --enablerepo='*' list all | grep firefox


    firefox.x86_64                          60.2.1-1.el6              @slf-security 


    firefox.i686                            60.2.1-1.el6              slf-security  


    firefox-debuginfo.i686                  60.2.2-1.el6              slf-debuginfo 


    firefox-debuginfo.x86_64                60.2.2-1.el6              slf-debuginfo 


    


    Andrei


    


    On Mon, 8 Oct 2018, Scott Reid wrote:


    


    > Synopsis:          Critical: firefox security update


    > Advisory ID:       SLSA-2018:2881-1


    > Issue Date:        2018-10-08


    > CVE Numbers:       CVE-2018-12386


    >                    CVE-2018-12387


    > --


    > 


    > This update upgrades Firefox to version 60.2.2 ESR.


    > 


    > Security Fix(es):


    > 


    > * Mozilla: type confusion in JavaScript (CVE-2018-12386)


    > 


    > * Mozilla: stack out-of-bounds read in Array.prototype.push


    > (CVE-2018-12387)


    > --


    > 


    > SL6


    >   x86_64


    >     firefox-60.2.2-1.el6.x86_64.rpm


    >     firefox-debuginfo-60.2.2-1.el6.x86_64.rpm


    >     firefox-60.2.2-1.el6.i686.rpm


    >     firefox-debuginfo-60.2.2-1.el6.i686.rpm


    >   i386


    >     firefox-60.2.2-1.el6.i686.rpm


    >     firefox-debuginfo-60.2.2-1.el6.i686.rpm


    > 


    > - Scientific Linux Development Team


    >

ATOM RSS1 RSS2