Subject: bug#719: Firefox-esr 91 have some vulnerabilities and apt-get can not delivery a newer version

From: Alter Kim <[email-masked]>
Date: Thu, 20 Oct 2022 04:29:10 +0000

Package: firefox-esr
Version: 91

 Hi !

 Since I read the firefox 91 have some serious bug/vuln issues

 I perform an update on my system

:~$sudo apt update
Get:1 http://deb.devuan.org/merged chimaera InRelease [33.5 kB]
Fetched 33.5 kB in 3s (9,913 B/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
80 packages can be upgraded. Run 'apt list --upgradable' to see them.

Ready to upgrade firefox

$ sudo apt-get install firefox-esr
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
firefox-esr is already the newest version (91.13.0esr-1~deb11u1).
firefox-esr set to manually installed.

I notice the update only give me the 91.13.0esr version

 If I take a look on the site[1] the 91.13.0esr version is vulnerable

[1]https://www.debian.org/security/2022/dsa-5259

 Also I see in this other site more info:

https://security.gentoo.org/glsa/202209-27

References

    CVE-2022-40956
    CVE-2022-40957
    CVE-2022-40958
    CVE-2022-40959
    CVE-2022-40960
    CVE-2022-40962

Affected versions       
 < 105.0
 < 102.3.0

Unaffected versions     
 >= 105.0
 >= 102.3.0

An extra check in the sources.list

$ cat /etc/apt/sources.list
# Package repositories
deb http://deb.devuan.org/merged chimaera main
#deb http://deb.devuan.org/merged chimaera-updates main
#deb http://deb.devuan.org/merged chimaera-security main
#deb http://deb.devuan.org/merged chimaera-backports main

In resume the update system can not delivery a safe version or a newer version of firefox-esr

 Thanks in advance for your time and for the time you take to solve this issue

 Cheers

---

From: Mark Hindley <[email-masked]>
Date: Thu, 20 Oct 2022 07:31:18 +0100

Alter,

>    Fetched 33.5 kB in 3s (9,913 B/s)

It looks as if you don't have security in your sources list.

Make sure /etc/apt/sources.list or a fragment in /etc/apt/sources.list.d/ contains

 deb http://deb.devuan.org/merged chimaera-security main

Mark

---

From: "Devuan bug Tracking System" <[email-masked]>
Date: Thu, 20 Oct 2022 08:28:03 +0000

This is an automatic notification regarding your bug report
which was filed against the firefox-esr package:

#719: Firefox-esr 91 have some vulnerabilities and apt-get can not delivery a newer version 

It has been closed by Mark Hindley <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mark Hindley <[email-masked]> by
replying to this email.

-- 
719: https://bugs.devuan.org/cgi/bugreport.cgi?bug=719
Devuan Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#719: Firefox-esr 91 have some vulnerabilities and apt-get can not delivery a newer version
From: Mark Hindley <[email-masked]>
To: Alter Kim <[email-masked]>
Cc: [email-masked]
Date: Thu, 20 Oct 2022 09:26:17 +0100

Alter,

On Thu, Oct 20, 2022 at 07:09:19AM +0000, Alter Kim wrote:
>     Hi Mark;
>     Yes, I have the security in my source list.
> 
>     ( But Is need it to remove the # to make it works, if other user(s)
>    don't remove that character the update to new versions of firefox can
>    not be deliverd  )

Well, not really if it is commented out.

Anyway, I am glad it works as expected when security is enabled.

>     Can be possible to add the newest package of firefox to the deb
>    http://deb.devuan.org/merged chimaera main  ??,please

When Debian does the next stable point release, I expect that will happen.

Mark

Subject: Firefox-esr 91 have some vulnerabilities and apt-get can not delivery a newer version
From: Alter Kim <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Thu, 20 Oct 2022 04:29:10 +0000

Package: firefox-esr
Version: 91

 Hi !

:~$sudo apt update

Ready to upgrade firefox

References

    CVE-2022-40956
    CVE-2022-40957
    CVE-2022-40958
    CVE-2022-40959
    CVE-2022-40960
    CVE-2022-40962

Affected versions       
 < 105.0
 < 102.3.0

Unaffected versions     

 Cheers