From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark H Weaver Subject: Re: Unpatched security flaws in GNU IceCat 38 Date: Thu, 04 Aug 2016 03:29:59 -0400 Message-ID: <87h9b1yoso.fsf@netris.org> References: <87lh0dz106.fsf@netris.org> <87wpjxdwdb.fsf@gnu.org> Mime-Version: 1.0 Content-Type: text/plain Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:42822) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVD6r-00025l-25 for guix-devel@gnu.org; Thu, 04 Aug 2016 03:30:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bVD6l-000100-Hj for guix-devel@gnu.org; Thu, 04 Aug 2016 03:30:27 -0400 In-Reply-To: <87wpjxdwdb.fsf@gnu.org> (Mike Gerwitz's message of "Wed, 03 Aug 2016 23:52:00 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Mike Gerwitz Cc: guix-devel@gnu.org Hi Mike, Mike Gerwitz writes: > On Wed, Aug 03, 2016 at 23:06:17 -0400, Mark H Weaver wrote: >> I'm sorry to report that GNU IceCat 38 can no longer be safely used, due >> to critical security flaws that are believed to allow remote code >> execution. I was unable to backport upstream fixes from 45.3 to 38. >> >> Until IceCat 45.3 is available, I recommend that you use Epiphany. > > Could you elaborate? I assume you're referencing this: > > https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr45.2 Drop the "#firefoxesr45.2" to see the fixes in 45.3 as well: https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/ Upstream IceCat 38 is surely vulnerable to many of the flaws listed as fixed in ESR 45.2 and 45.3. The patched version of IceCat in GNU Guix does not include fixes from 45.3, but includes my "best effort" attempt to backport the most important fixes from ESR 45.2: http://git.savannah.gnu.org/cgit/guix.git/commit/?id=98d9182205e6655a0a55f1eadc84a0c9a1cdd9fa Although I felt sufficiently satisfied with the results to continue using IceCat before the 45.3 fixes were announced, I must stress that I am *not* familiar with the Mozilla code, and do not consider myself competent to reliably backport these fixes across 7 major versions of Firefox. (Also note that my backported fixes do *not* include critical fixes to the bundled copies of cairo and libvpx in IceCat, because in Guix we delete those bundled copies.) More specifically, I ran into difficulties attempting to backport the following changesets from the upstream mozilla-esr45 mercurial repo: [Critical] memory safety bugs (CVE-2016-2836): changeset: 312137:3a0deb9801ab user: Jon Coppeard Date: Wed Jun 29 10:04:25 2016 +0100 summary: Bug 822081 - Allow barriers to fire while tracing the heap r=terrence a=abillings a=ritu changeset: 312162:1188098e26d5 user: Seth Fowler Date: Tue Jun 21 17:56:24 2016 -0700 summary: Bug 1249578 (Part 1) - Verify that the size in the BIH header matches the ICO directory entry instead of fixing it. r=njn a=abillings, a=sylvestre [Critical] WebRTC - Use After Free in socket thread (CVE-2016-5258): changeset: 312151:cc258670af8f user: Nils Ohlmeier [:drno] Date: Wed Jul 13 15:49:47 2016 -0700 summary: Bug 1279146 - Clean up streams on shutdown. r=bwc, a=lizzard [Critical] Yet another Use After Free in CanonicalizeXPCOMParticipant (CVE-2016-5259): changeset: 312145:380c05fc7d7f user: Andrea Marchesini Date: Wed Jul 06 08:36:54 2016 +0200 summary: Bug 1282992 - Improve sync event loop shutdown in workers, r=khuey a=ritu [High] Favicon request doesn't timeout, or close when related window is closed (CVE-2016-2830): (mozilla bug 1255270; unable to find associated changeset) [High] Heap-buffer-overflow in nsBidi::BracketData::AddOpening (CVE-2016-2838): changeset: 312120:5ffdebd7418e user: Jonathan Kew Date: Wed Jun 15 22:04:48 2016 +0100 summary: Bug 1279814 - Update mIsoRunLast index when handling PDI. r=xidorn, a=sylvestre [High] stack-buffer-overflow in mozilla::gfx::BasePoint4d (CVE-2016-5252): changeset: 312123:910b8f21e777 user: Carsten "Tomcat" Book Date: Thu Jun 23 12:41:04 2016 +0200 summary: Bug 1268854 - Break out of loop if no intersecting points on positive side of clipping plane. r=kip, a=sylvestre [High] Type confusion in nsDisplayList::HitTest (CVE-2016-5263): (mozilla bug 1276897; unable to find associated changeset) [Moderate] Heap-use-after-free in nsXULPopupManager::KeyDown (CVE-2016-5254): (mozilla bug 1266963; unable to find associated changeset) [Moderate] XSS out of iframe sandbox, iframe disabled javascript. marquee (CVE-2016-5262): (mozilla bug 1277475; unable to find associated changeset) [Moderate] Same origin policy bypass in local document/Universal xss (CVE-2016-5265): changeset: 312157:3e8a4fa8cb04 user: Christoph Kerschbaumer Date: Wed Jun 22 17:15:06 2016 +0200 summary: Bug 1278013 - Remove SEC_FORCE_INHERIT_PRINCIPAL from loadinfo within baseChannel::Redirect. r=bz, a=sylvestre > Are you going to be publishing an announcement about this? Sorry if I > missed it; gnu.org/s/icecat doesn't mention anything. I do not have access to modify gnu.org/s/icecat. I raised an alarm on the Gnuzilla development list at the time, but so far there has been no developer response. http://lists.gnu.org/archive/html/bug-gnuzilla/2016-06/msg00005.html Mark