Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 778269 (CVE-2021-23983, CVE-2021-23985, CVE-2021-23986, CVE-2021-23988) - <www-client/firefox{,-bin}-{78.9.0,87.0}: multiple vulnerabilities (CVE-2021-{23983,23985,23986,23988})
Summary: <www-client/firefox{,-bin}-{78.9.0,87.0}: multiple vulnerabilities (CVE-2021-...
Status: RESOLVED FIXED
Alias: CVE-2021-23983, CVE-2021-23985, CVE-2021-23986, CVE-2021-23988
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal major
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa+ cve]
Keywords:
Depends on:
Blocks: CVE-2021-23981, CVE-2021-23982, CVE-2021-23984, CVE-2021-23987, MOZ-2021-0002
  Show dependency tree
 
Reported: 2021-03-25 21:43 UTC by John Helmert III
Modified: 2021-05-01 00:03 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-25 21:43:59 UTC 
See tracker for details. Please stabilize 78.9.0.
Comment 1 Aditya Som 2021-03-27 17:06:42 UTC 
Can someone please bump this for stabilization soon? We are still living with this exposed vulnerability while other distros like Debian have already updated their packages few days back. Not everyone wants to use a mix of "~amd64" and -bin packages in their systems.
Comment 2 Larry the Git Cow gentoo-dev 2021-03-27 20:50:16 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fc69d7f8d6e96fe720bb851315af573f74b26ee7

commit fc69d7f8d6e96fe720bb851315af573f74b26ee7
Author:     Thomas Deutschmann <whissi@gentoo.org>
AuthorDate: 2021-03-27 20:49:21 +0000
Commit:     Thomas Deutschmann <whissi@gentoo.org>
CommitDate: 2021-03-27 20:50:11 +0000

    www-client/firefox: amd64 & x86 stable
    
    Bug: https://bugs.gentoo.org/778269
    Package-Manager: Portage-3.0.17, Repoman-3.0.2
    Signed-off-by: Thomas Deutschmann <whissi@gentoo.org>

 www-client/firefox/firefox-78.9.0.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
Comment 3 Thomas Deutschmann (RETIRED) gentoo-dev 2021-03-27 20:51:03 UTC 
amd64 & x86 stable
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-03-30 22:06:53 UTC 
arm64 done

all arches done
Comment 5 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-03-31 00:47:04 UTC 
Please cleanup.
Comment 6 Larry the Git Cow gentoo-dev 2021-04-06 11:06:02 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=99c36fb11209072c5ccb5b2b2073dbc4801338c6

commit 99c36fb11209072c5ccb5b2b2073dbc4801338c6
Author:     Joonas Niilola <juippis@gentoo.org>
AuthorDate: 2021-04-06 11:03:43 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2021-04-06 11:05:53 +0000

    www-client/firefox: security cleanup
    
    Bug: https://bugs.gentoo.org/778269
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 www-client/firefox/Manifest              |  289 --------
 www-client/firefox/firefox-78.8.0.ebuild | 1183 ------------------------------
 www-client/firefox/firefox-86.0.1.ebuild | 1173 -----------------------------
 www-client/firefox/firefox-86.0.ebuild   | 1173 -----------------------------
 4 files changed, 3818 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9f33a6f8f543907b719b176ec0fcf803392bd86f

commit 9f33a6f8f543907b719b176ec0fcf803392bd86f
Author:     Joonas Niilola <juippis@gentoo.org>
AuthorDate: 2021-04-06 11:02:56 +0000
Commit:     Joonas Niilola <juippis@gentoo.org>
CommitDate: 2021-04-06 11:05:53 +0000

    www-client/firefox-bin: security cleanup
    
    Bug: https://bugs.gentoo.org/778269
    Signed-off-by: Joonas Niilola <juippis@gentoo.org>

 www-client/firefox-bin/Manifest                  | 291 ----------------
 www-client/firefox-bin/firefox-bin-78.8.0.ebuild | 411 -----------------------
 www-client/firefox-bin/firefox-bin-86.0.1.ebuild | 411 -----------------------
 www-client/firefox-bin/firefox-bin-86.0.ebuild   | 411 -----------------------
 4 files changed, 1524 deletions(-)
Comment 7 Thomas Deutschmann (RETIRED) gentoo-dev 2021-04-30 23:47:18 UTC 
Added to an existing GLSA request.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2021-05-01 00:03:13 UTC 
This issue was resolved and addressed in
 GLSA 202104-10 at https://security.gentoo.org/glsa/202104-10
by GLSA coordinator Thomas Deutschmann (whissi).