Update to latest version due to security updates and 8.0.1 not being
available on the mirrors anymore.
Release notes: https://blog.torproject.org/new-release-tor-browser-802
(cherry picked from commit 248ed3575c41866c657d0aa2f4a70ebb7a2c079a)
snapshot.debian.org actually keeps track of all of the updates as they
come in rather than doing arbitrary (?) snapshots.
(cherry picked from commit 9cc18fa7f969e7671a34cf85e6296be9e9823f63)
This is a sort port of 4d6f880 (#43811). The mentioned issues are not
being fixed in the release. The CPU release should be used instead.
Since someone might still need the PSU version it will just be marked as
insecure allowing the user to whitelist it, if required.
Highlights in this release include:
This release fixes problems with argument handling, some unintended results of the security fixes to the SAFER file access restrictions (specifically accessing ICC profile files), and some additional security issues over the recent 9.24 release.
CVE-2018-16802
CVE-2018-17183
Note: The ps2epsi utility does not, and cannot call Ghostscript with the -dSAFER command line option. It should never be called with input from untrusted sources.
Security issues have been the primary focus of this release, including solving several (well publicised) real and potential exploits.
PLEASE NOTE: We strongly urge users to upgrade to this latest release to avoid these issues.
As well as Ghostscript itself, jbig2dec has had a significant amount of work improving its robustness in the face of out specification files.
IMPORTANT: We are in the process of forking LittleCMS. LCMS2 is not thread safe, and cannot be made thread safe without breaking the ABI. Our fork will be thread safe, and include performance enhancements (these changes have all be been offered and rejected upstream). We will maintain compatibility between Ghostscript and LCMS2 for a time, but not in perpetuity. Our fork will be available as its own package separately from Ghostscript (and MuPDF).
The usual round of bug fixes, compatibility changes, and incremental improvements.
(cherry picked from commit 5b77b0d2f1eda9a42fe188eafb499230741e7925)
(cherry picked from commit dbcbf7cce8be7f14e6f299fca1227627cd539704)
(cherry picked from commit 4f519e5dc8d41acfc31ded7b1bbb46b55aa23e3a)
Reason: Security update: "The pam_fscrypt module in fscrypt before 0.2.4
may incorrectly restore primary and supplementary group IDs to the
values associated with the root user, which allows attackers to gain
privileges via a successful login through certain applications that use
Linux-PAM (aka pam)."
(cherry picked from commit 18b468ed8186131d5a8a6590ff10253e12d0195a)
Reason: Security update: "Depend on new version of gollum-lib that
relies on a patched version of sanitize, which solves a vulnerability
(CVE-2018-3740). See https://github.com/gollum/gollum-lib/pull/296."
(cherry picked from commit 265c5fc485267a2be8ca5d555bc247766bc72dbc)
Reason: Security update: "Solves a vulnerability in the File view and
All Pages view that would allow XSS."
This is a port of the current state of thunderbird from the master
branch. We did miss a bunch of security fixes when thunderbird 60 was
released. This is an attempt to take a shortcut by simply copying over
the expression from the master branch.
Security related fixes in this release are:
- CVE-2018-12359: Buffer overflow using computed size of canvas element
A buffer overflow can occur when rendering canvas content while
adjusting the height and width of the <canvas> element dynamically,
causing data to be written outside of the currently computed
boundaries. This results in a potentially exploitable crash.
- CVE-2018-12360: Use-after-free when using focus()
A use-after-free vulnerability can occur when deleting an input
element during a mutation event handler triggered by focusing that
element. This results in a potentially exploitable crash.
- CVE-2018-12361: Integer overflow in SwizzleData
An integer overflow can occur in the SwizzleData code while
calculating buffer sizes. The overflowed value is used for subsequent
graphics computations when their inputs are not sanitized which
results in a potentially exploitable crash.
- CVE-2018-12362: Integer overflow in SSSE3 scaler
An integer overflow can occur during graphics operations done by the
Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in
a potentially exploitable crash.
- CVE-2018-5156: Media recorder segmentation fault when track type is changed during capture
A vulnerability can occur when capturing a media stream when the media
source type is changed as the capture is occuring. This can result in
stream data being cast to the wrong type causing a potentially
exploitable crash.
- CVE-2018-12363: Use-after-free when appending DOM nodes
A use-after-free vulnerability can occur when script uses mutation
events to move DOM nodes between documents, resulting in the old
document that held the node being freed but the node still having a
pointer referencing it. This results in a potentially exploitable
crash.
- CVE-2018-12364: CSRF attacks through 307 redirects and NPAPI plugins
NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin
requests, bypassing CORS by making a same-origin POST that does a 307
redirect to the target site. This allows for a malicious site to
engage in cross-site request forgery (CSRF) attacks.
- CVE-2018-12365: Compromised IPC child process can list local filenames
A compromised IPC child process can escape the content sandbox and
list the names of arbitrary files on the file system without user
consent or interaction. This could result in exposure of private local
files.
- CVE-2018-12371: Integer overflow in Skia library during edge builder allocation
An integer overflow vulnerability in the Skia library when allocating
memory for edge builders on some systems with at least 16 GB of RAM.
This results in the use of uninitialized memory, resulting in a
potentially exploitable crash.
- CVE-2018-12366: Invalid data handling during QCMS transformations
An invalid grid size during QCMS (color profile) transformations can
result in the out-of-bounds read interpreted as a float value. This
could leak private data into the output.
- CVE-2018-12367: Timing attack mitigation of PerformanceNavigationTiming
In the previous mitigations for Spectre, the resolution or precision
of various methods was reduced to counteract the ability to measure
precise time intervals. In that work, PerformanceNavigationTiming was
not adjusted but it was found that it could be used as a precision
timer.
- CVE-2018-5187: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, and Thunderbird 60
Mozilla developers and community members Christian Holler, Sebastian
Hengst, Nils Ohlmeier, Jon Coppeard, Randell Jesup, Ted Campbell, Gary
Kwong, and Jean-Yves Avenard reported memory safety bugs present in
Firefox 60 and Firefox ESR 60. Some of these bugs showed evidence of
memory corruption and we presume that with enough effort that some of
these could be exploited to run arbitrary code.
- CVE-2018-5188: Memory safety bugs fixed in Firefox 61, Firefox ESR 60.1, Firefox ESR 52.9, and Thunderbird 60
Mozilla developers and community members Alex Gaynor, Christoph Diehl,
Christian Holler, Jason Kratzer, David Major, Jon Coppeard, Nicolas B.
Pierron, Jason Kratzer, Marcia Knous, and Ronald Crane reported memory
safety bugs present in Firefox 60, Firefox ESR 60, and Firefox ESR
52.8. Some of these bugs showed evidence of memory corruption and we
presume that with enough effort that some of these could be exploited
to run arbitrary code.
This update bumps the package to the latest stable version containing a
few security fixes:
- CVE-2018-12386: Type confusion in JavaScript
A vulnerability in register allocation in JavaScript can lead to type
confusion, allowing for an arbitrary read and write. This leads to
remote code execution inside the sandboxed content process when
triggered.
- CVE-2018-12387
A vulnerability where the JavaScript JIT compiler inlines
Array.prototype.push with multiple arguments that results in the stack
pointer being off by 8 bytes after a bailout. This leaks a memory
address to the calling function which can be used as part of an
exploit inside the sandboxed content process.
Source: https://www.mozilla.org/en-US/security/advisories/mfsa2018-24/
(cherry picked from commit 246d2848ff657d56fcf2d8596709e8869ce8616a)
Michael Weiss
Florian Jacob
Tim Steinbach
Franz Pletz
Ben Challenor
Chloe Kever
Thomas Bach
taku0
R. RyanTM
Andreas Rammhold
Joachim F
Joachim Fasting
Linus Heckemann
pacien
Florian Klink
edef