pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: pkgsrc/www/firefox45
Module Name: pkgsrc
Committed By: ryoon
Date: Wed Sep 21 11:51:14 UTC 2016
Modified Files:
pkgsrc/www/firefox45: Makefile distinfo
Log Message:
Update to 45.4.0
Changelog:
Security vulnerabilities fixed in Firefox ESR 45.4
Announced
September 13, 2016
Impact
Critical
Products
Firefox ESR
Fixed in
Firefox ESR 45.4
Description
CVE-2016-5270 - Heap-buffer-overflow in nsCaseTransformTextRunFactory::TransformString [high]
Reporter: Atte Kettunen
Description: An out-of-bounds write of a boolean value during text conversion with some unicode characters. [1291016]
CVE-2016-5272 - Bad cast in nsImageGeometryMixin [high]
Reporter: Abhishek Arya
Description: A bad cast when processing layout with input elements can result in a potentially exploitable crash. [1297934]
CVE-2016-5276 - Heap-use-after-free in mozilla::a11y::DocAccessible::ProcessInvalidationList [high]
Reporter: Nils
Description: A use-after-free vulnerability triggered by setting a aria-owns attribute [1287721]
CVE-2016-5274 - use-after-free in nsFrameManager::CaptureFrameState [high]
Reporter: Nils
Description: A use-after-free issue in web animations during restyling. [1282076]
CVE-2016-5277 - Heap-use-after-free in nsRefreshDriver::Tick [high]
Reporter: Nils
Description: A user-after-free vulnerability with web animations when destroying a timeline [1291665]
CVE-2016-5278 - Heap-buffer-overflow in nsBMPEncoder::AddImageFrame [critical]
Reporter: Nils
Description: A potentially exploitable crash caused by a buffer overflow while encoding image frames to images [1294677]
CVE-2016-5280 - Use-after-free in mozilla::nsTextNodeDirectionalityMap::RemoveElementFromMap [high]
Reporter: Mei Wang
Description: Use-after-free vulnerability when changing text direction [1289970]
CVE-2016-5281 - use-after-free in DOMSVGLength [high]
Reporter: Brian Carpenter
Description: Use-after-free vulnerability when manipulating SVG format content through script [1284690]
CVE-2016-5284 - Add-on update site certificate pin expiration [high]
Reporter: Multiple people
Description: Due to flaws in the process we used to update "Preloaded Public Key Pinning" in our releases, the pinning for add-on updates became ineffective in early September. An attacker who was
able to get a mis-issued certificate for a Mozilla web site could send malicious add-on updates to users on networks controlled by the attacker. Users who have not installed any add-ons are not
affected. [1303127]
CVE-2016-5250 - Resource Timing API is storing resources sent by the previous page [moderate]
Reporter: Catalin Dumitru
Description: URLs of resources loaded after a navigation started can leak to the following page through the Resource Timing API, leading to potential information disclosure. [1254688]
CVE-2016-5261 - Integer overflow and memory corruption in WebSocketChannel [high]
Reporter: Samuel Groß
Description: An integer overflow error in WebSockets during data buffering on incoming packets resulting in attacker controlled data being written at a known offset in the allocated buffer. [1287266]
CVE-2016-5257 - Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4 [critical]
Reporter: Mozilla developers
Description: Mozilla developers and community members Christoph Diehl, Andrew McCreight, Dan Minor, Byron Campen, Jon Coppeard, Steve Fink, Tyson Smith, Philipp, and Carsten Book reported memory
safety bugs present in Firefox 48 and Firefox ESR 45.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort at least some of these could be exploited to run
arbitrary code. [Memory safety bugs fixed in Firefox 49 and Firefox ESR 45.4]
To generate a diff of this commit:
cvs rdiff -u -r1.10 -r1.11 pkgsrc/www/firefox45/Makefile
cvs rdiff -u -r1.6 -r1.7 pkgsrc/www/firefox45/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/www/firefox45/Makefile
diff -u pkgsrc/www/firefox45/Makefile:1.10 pkgsrc/www/firefox45/Makefile:1.11
--- pkgsrc/www/firefox45/Makefile:1.10 Sat Aug 20 23:17:00 2016
+++ pkgsrc/www/firefox45/Makefile Wed Sep 21 11:51:14 2016
@@ -1,13 +1,12 @@
-# $NetBSD: Makefile,v 1.10 2016/08/20 23:17:00 maya Exp $
+# $NetBSD: Makefile,v 1.11 2016/09/21 11:51:14 ryoon Exp $
MOZILLA_PKG_NAME= firefox45
FIREFOX_VER= ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH= 45.3
+MOZ_BRANCH= 45.4
MOZ_BRANCH_MINOR= .0esr
DISTNAME= firefox-${FIREFOX_VER}.source
PKGNAME= ${MOZILLA_PKG_NAME}-${MOZ_BRANCH}${MOZ_BRANCH_MINOR:S/b/beta/:S/esr//}
-PKGREVISION= 1
CATEGORIES= www
MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}
Index: pkgsrc/www/firefox45/distinfo
diff -u pkgsrc/www/firefox45/distinfo:1.6 pkgsrc/www/firefox45/distinfo:1.7
--- pkgsrc/www/firefox45/distinfo:1.6 Thu Aug 11 04:24:03 2016
+++ pkgsrc/www/firefox45/distinfo Wed Sep 21 11:51:14 2016
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.6 2016/08/11 04:24:03 ryoon Exp $
+$NetBSD: distinfo,v 1.7 2016/09/21 11:51:14 ryoon Exp $
-SHA1 (firefox-45.3.0esr.source.tar.xz) = e019408b46ecd8c5c1b3beae01a522b57acaa4b9
-RMD160 (firefox-45.3.0esr.source.tar.xz) = 90b2434f0b245115726916257933db33caad4425
-SHA512 (firefox-45.3.0esr.source.tar.xz) = ee618aec579625122c3e511a7ac83ac4db9718f5695b6fe6250717602178bae9bb7e5ebe8764f4d33ecf44d3db13abfed0d24c1ec71e64a1087fb6d5a579b0c0
-Size (firefox-45.3.0esr.source.tar.xz) = 185330580 bytes
+SHA1 (firefox-45.4.0esr.source.tar.xz) = 3892aa3ecadfd5fc0533f7847cd959baef3be10e
+RMD160 (firefox-45.4.0esr.source.tar.xz) = 6f1b10e51f15225b812db73335698311947ccdda
+SHA512 (firefox-45.4.0esr.source.tar.xz) = 2955e02f829a10186a8b22320fb97d4b0fc2b45721fcffa6295653fd760d516ae72b5656547685ba1e0699b381e28044996d9ee12a8738842b4e6b8acd296715
+Size (firefox-45.4.0esr.source.tar.xz) = 185182396 bytes
SHA1 (patch-aa) = c97ef4b107ea917c2a10d1a1fdaf524d794612a0
SHA1 (patch-ao) = f4244b8e3d89743cb97395913e8916f7121c172e
SHA1 (patch-as) = d5d7f8250a9cd462f25d529c2a79c59a1bba9db2
Home |
Main Index |
Thread Index |
Old Index