| Summary: | <mail-client/thunderbird{,-bin}-60.3.0 - multiple vulnerabilities (MFSA-2018-28) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Ian Stakenvicius (RETIRED) <axs> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | Manfred.Knick |
| Priority: | Normal | Flags: | stable-bot:
sanity-check+
|
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://www.mozilla.org/en-US/security/advisories/mfsa2018-28/ | ||
| Whiteboard: | B2 [glsa+ cve] | ||
| Package list: |
=mail-client/thunderbird-60.3.0
|
Runtime testing required: | --- |
|
Description
Ian Stakenvicius (RETIRED)
2018-11-01 17:59:10 UTC
Ebuilds pushed to gentoo repo. Arches please stabilize when ready. Please, see Bug 670104 : mail-client/thunderbird-60.3.0 thunderbird-60.3.0-de.xpi Filesize does not match recorded size x86 stable amd64 stable @ Maintainer(s): Please cleanup and drop <mail-client/thunderbird-60.3.0! Somehow the =mail-client/thunderbird-bin-60.3.0 atom in the package list was eaten.. I see where I added it but not where it was dropped. Anyways, I've pushed it directly to stable as well (since there's noting we can do about it anyways, binary package and all). Versions prior to 60.0 are p.masked for removal by year-end -- the jump from 52 to 60 could still be problematic for some deployments. New GLSA request filed. Update broken. Portage does not install 60+ version but wants to remove 60- versions due to masking. Can you please fix this so either 60+ can be emerged or push back the masking of 60- until this issue is fixed? (My report is based on a fresh sync today) (In reply to Plüss Roland from comment #8) > Update broken. Portage does not install 60+ version but wants to remove 60- > versions due to masking. Can you please fix this so either 60+ can be > emerged or push back the masking of 60- until this issue is fixed? > > (My report is based on a fresh sync today) Please file a new bug with all the usual details. There should not be a reason for portage disallowing an update to 60+ This issue was resolved and addressed in GLSA 201811-13 at https://security.gentoo.org/glsa/201811-13 by GLSA coordinator Aaron Bauman (b-man). (In reply to GLSAMaker/CVETool Bot from comment #10) > This issue was resolved and addressed in > GLSA 201811-13 at https://security.gentoo.org/glsa/201811-13 > by GLSA coordinator Aaron Bauman (b-man). Just realized that . . . [-P-] [M ] mail-client/thunderbird-52.9.1:0 is still contained in MainPortageTree ? (In reply to Manfred Knick from comment #11) > (In reply to GLSAMaker/CVETool Bot from comment #10) > > This issue was resolved and addressed in > > GLSA 201811-13 at https://security.gentoo.org/glsa/201811-13 > > by GLSA coordinator Aaron Bauman (b-man). > Just realized that > > . . . [-P-] [M ] mail-client/thunderbird-52.9.1:0 > > is still contained in MainPortageTree ? ...which isn't a problem and package is masked with a clear message indicating security problems: > on behalf of Mozilla Project Mask old/vuln thunderbird for removal by 2019, see security bug 670102 (In reply to Thomas Deutschmann from comment #12) > ...which isn't a problem and package is masked with a clear message > indicating security problems: Sure, Thomas! That's exactly why I cited the "[M ]" in front. Just wondering why all the later versions in between have been deleted, but exactly this one is being kept. I definitely expected that to have it's reason behind - but I was not able to find out which one; can you help with a hint? 52.9.1 is the last version in the 52.x series, the 60.x series has some regressions compared to 52.x. New versions being released in 60.x are security and bugfix updates to previous releases in the 60.x series and so it doesn't make sense to keep them around. We will likely keep the last of the 60.x series in the repo for a while as we continue to update the 68.x series for similar reasons, although I read a note from upstream that 68.2.2 should address all regressions. (In reply to Ian Stakenvicius from comment #14) Ian, thank you for enlightening me, very much! > ... I read a > note from upstream that 68.2.2 should address all regressions. Could you perhaps share a reference, please, as info for Bug 693602 ? The current package list in this bug includes -bin version. However, it is not in sync with the src version. Did you forget about it -bin? Please sync. No. Multiple things to keep in mind: 1) You are writing in an old, already closed bug from 1y ago. 2) mail-client/thunderbird-bin ebuilds will be committed straight to stable, therefore they will never show in package list in security bugs (only summary) because package list field is only for stabilization work. |
