Updated firefox packages fix security vulnerabilities

2018-01-2516:36:49

Gentoo Foundation

advisories.mageia.org

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.006

Percentile

79.6%

JSON

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2018-5089, CVE-2018-5091, CVE-2018-5095, CVE-2018-5096, CVE-2018-5097, CVE-2018-5098, CVE-2018-5099, CVE-2018-5102, CVE-2018-5103, CVE-2018-5104, CVE-2018-5117). To mitigate timing-based side-channel attacks similar to “Spectre” and “Meltdown”, the resolution of performance.now() has been reduced from 5μs to 20μs.

OSVersionArchitecturePackageVersionFilename
Mageia5noarchnspr< 4.18-1nspr-4.18-1.mga5
Mageia5noarchrootcerts< 20180104.00-1rootcerts-20180104.00-1.mga5
Mageia5noarchnss< 3.28.6-1.3nss-3.28.6-1.3.mga5
Mageia5noarchfirefox< 52.6.0-1firefox-52.6.0-1.mga5
Mageia5noarchfirefox-l10n< 52.6.0-1firefox-l10n-52.6.0-1.mga5

OS	Version	Architecture	Package	Version	Filename
Mageia	5	noarch	nspr	< 4.18-1	nspr-4.18-1.mga5
Mageia	5	noarch	rootcerts	< 20180104.00-1	rootcerts-20180104.00-1.mga5
Mageia	5	noarch	nss	< 3.28.6-1.3	nss-3.28.6-1.3.mga5
Mageia	5	noarch	firefox	< 52.6.0-1	firefox-52.6.0-1.mga5
Mageia	5	noarch	firefox-l10n	< 52.6.0-1	firefox-l10n-52.6.0-1.mga5