HomeSolus

Update firefox to 64.0 to address multiple CVEs

Authored by kyrios123 on Dec 12 2018, 9:12 AM.

Description

Update firefox to 64.0 to address multiple CVEs

Summary:
Security:

  • CVE-2018-12407: Buffer overflow with ANGLE library when using VertexBuffer11 module
  • CVE-2018-17466: Buffer overflow and out-of-bounds read in ANGLE library with TextureStorage11
  • CVE-2018-18492: Use-after-free with select element
  • CVE-2018-18493: Buffer overflow in accelerated 2D canvas with Skia
  • CVE-2018-18494: Same-origin policy violation using location attribute and performance.getEntries to steal cross-origin URLs
  • CVE-2018-18495: WebExtension content scripts can be loaded in about: pages
  • CVE-2018-18496: Embedded feed preview page can be abused for clickjacking
  • CVE-2018-18497: WebExtensions can load arbitrary URLs through pipe separators
  • CVE-2018-18498: Integer overflow when calculating buffer sizes for images
  • CVE-2018-12406: Memory safety bugs fixed in Firefox 64
  • CVE-2018-12405: Memory safety bugs fixed in Firefox 64 and Firefox ESR 60.4

Release notes available here

Packaging:

  • Build with LTO
  • Enable action menus, resolves T7306

Signed-off-by: Pierre-Yves <pyu@riseup.net>

Test Plan:
Browsed a few websites, play a video on youtube.
I haven't checked why a few extensions are gone.

Reviewers: Triage Team, JoshStrobl

Reviewed By: Triage Team, JoshStrobl

Subscribers: sunnyflunk, JoshStrobl

Tags: #security

Maniphest Tasks: T7306

Differential Revision: https://dev.getsol.us/D4624

Details

Committed
sunnyflunkDec 12 2018, 9:13 AM
Pushed
sunnyflunkDec 12 2018, 9:13 AM
Reviewer
Triage Team
Differential Revision
Restricted Differential Revision
Parents
R755:95b44b6a8750: Update langpacks to 64.0
Branches
Unknown
Tags
Unknown
References
tag: firefox-64.0-146
Tasks
T7306: [RFC] add a "new tab" Desktop Action to Firefox

On line 237, I see English for Myanmar (Burmese) [my]:

On line 237, I see English for Myanmar (Burmese) [my]:

If you have the correct translation, feel free to update it.

I don't know how to do that, Google Translate shows: အသစ်ကပုဂ္ဂလိကပြတင်းပေါက်

I won't update this for a google translation without any validation from someone who speaks the language. English is better than a bad/approximate translation imo.

fe984e01f4aa : note I won't publish an update just for this so it will be for the next time