Re: [SECURITY] [DSA 5113-1] firefox-esr security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Elmar Stellnberger on Thursday., 2022-04-14T18:51:01+0200:
>
>> Where can I get this from for buster and architecture i386?  
>> <http://security.debian.org/debian-security/dists/buster/updates/main/binary-i386/Packages.xz> 
>> does not have it.
>
>  Friedhelm, how have you taken notice about this issue?
>Was the file really not there or do you think you have forgotten to 
>type firefox-esr instead of firefox or something the like?

Yes, for i386 it is really not there:

$ apt-cache policy firefox-esr
firefox-esr:
  Candidate: 78.15.0esr-1~deb10u1
  Version table:
     91.8.0esr-1~deb11u1 50
         50 http://apt-cache.zuhause.test:3142/debian-security bullseye-security/main i386 Packages
     78.15.0esr-1~deb11u1 50
         50 http://apt-cache.zuhause.test:3142/debian bullseye/main i386 Packages
     78.15.0esr-1~deb10u1 500
        500 http://apt-cache.zuhause.test:3142/debian-security buster/updates/main i386 Packages
     78.14.0esr-1~deb10u1 500
        500 http://apt-cache.zuhause.test:3142/debian buster/main i386 Packages
     78.12.0esr-1 50
         50 file:/media/root/Debian 11.0.0 i386 1/debian bullseye/main i386 Packages

On apt-cache.zuhause.test I run an apt-cacher-ng that maps 
http://apt-cache.zuhause.test:3142/debian to

http://deb.debian.org/debian/
http://ftp.de.debian.org/debian/
http://ftp2.de.debian.org/debian/
http://ftp.debian.org/debian/

, which are considered to be equal, and 
http://apt-cache.zuhause.test:3142/debian-security to

http://security.debian.org/debian-security
http://deb.debian.org/debian-security

, which are considered to be equal.

At present I have pinned to priority 50 all package versions 
belonging to any release whose codename matches »bullseye*« with 
a rule in /etc/apt/preferences.  When I am ready to upgrade to 
bullseye, I will remove that rule.

So the newest firefox-esr in buster for i386 is 
78.15.0esr-1~deb10u1, and that is broken.

>
>> Package        : firefox-esr
>> CVE ID         : CVE-2022-1097  CVE-2022-1196  CVE-2022-24713
>>                  CVE-2022-28281 CVE-2022-28282 CVE-2022-28285
>>                  CVE-2022-28286 CVE-2022-28289
>>
>> Multiple security issues have been found in the Mozilla 
>> Firefox web browser,
[…]
>> For the oldstable distribution (buster), these problems have 
>> been fixed in version 91.8.0esr-1~deb10u1.
[…]
>> We recommend that you upgrade your firefox-esr packages.
>
> At me it apparently has really kept an old unfixed version.

Exactly.

>The message says fixed for oldstable, not mentioning that the fix has 
>not yet been achieved for i386 and that it was only applied to amd64.

Yes, so it is.


Regards,
Friedhelm.

My OpenPGP key:

- -----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFoCvhgBCADnymmMgAzxsUqP9GPSK+QJATL4w/C8KS7ghUdu7TT4mdEfMfgI
BteRnqWJvLzlBFlQRBEXQphxfgtAdTAZDdAlcyXkcA19Sb0Z09/oQgPe4vp99Cnp
kq2GPOxSk6YQrfs4FF6p4lsQUz0TKONSztZGo4VSyT1G+LpsSxm7Q1YUzpO4j5fy
XfPMB/TdhpJbKlE4yVldwVdt4+Gc8oTeohVkZZtVx9bplmaVLaj35HrRTupj75IS
tooF5dTVLQVhQYKqDCd2DKiZiUuKt6K9ZtrpmjnWaWRayKmJdJ14R8/Q7VfSyXOx
fLb4DNDz4FNUPOvHdXYjhsTz1U6v1kaddMXdABEBAAG0E0ZyaWVkaGVsbSBXYWl0
em1hbm6JAWAEEwEKAEoCGwECHgECF4ALCw0JCgwICwcEAwIIFQoJCAsDAgEFFgMC
AQACGQEFCQuP3SgWIQRGyPH+W3hgUPhyflPQtV81ksAM7QUCYbLp7wAKCRDQtV81
ksAM7cr5B/wO1khGTl3dAh46DY2jxe3jTfPvicbQgZQVwOhhP2FPKIFC8dYVCEHk
oYQapW47YXufw/Qw71GILfMtZemiUJpHwa/thCPtP3clE53ZqsEdArHDX2ZYm3Ol
qDTxMuilQCDfGuatg6MVQ8SlUbhcGIGyr4O4cPeDe0kmUOQhp8wKTXkmhq3Yml5+
2XRu69TZUNsQh3TPi50hR+RB0YjI+KTBKYSanAYM44Bj6mti6+06UkRVMaFxLVzS
BAEyTf/SBaKkJq4cKe+gCzcc/Gg8jrxKVcQRPdUxOlvWUiYT5FYRaFuklgDW4B+g
23FdO6RkE0Z+g/oLeAYSqj/JMfjv77bFtBlmYWNoMjIwNDA4LmZ3bnNwQHhveHku
bmV0iQFdBBMBCgBHFiEERsjx/lt4YFD4cn5T0LVfNZLADO0FAmJQFg8CGwEFCQuP
3SgLCw0JCgwICwcEAwIIFQoJCAsDAgEFFgMCAQACHgECF4AACgkQ0LVfNZLADO2V
ygf9HQWjolhnGRNWG5845lh2uTrm/5q19+hKwnQHx7HApZia09kXp7QpxTCmSmnq
skWto08U/iT1sPqFTOojOZAM6e4zr7kz/VJksJx8lswUkTRyGXqGEQoQ7bZvd6XR
Yu0ZKfNNZhvjfPzzwyp+85lWWIaNA0cQyIa6BRzlNhgCbyLhksy4GDkzoBPxhNOp
mboohSVOnLjrUbQpfKCDJtAaNps95+4gv2t8JPtyFcZW9qKWFRIdJJvamc3lp4Il
JwzXRElB1htSHQb4SA2VN9M6ALdnfZXXT+H8UKKek+joE8Xm15FX83E5pmrE/8lp
imVg0s0BAUd0DxVj6zj4SI9yhrkBDQRaAsK/AQgAyBEE1hjgZ6F33GPSkfxsFqsN
L5lQrRTQtx5GKPt5UnIKK00TAevGoI8VDftuP6Fpp9kFJ+HSAiW3M+8S70H3UnbW
8AFofSd28AUvnnhP4ATwRcVm35+HYUge4lKiy5bEvDS9bALJqlW9sHBUF+gebrmh
0CgvD0sQSUE4PLAuHFUJG8/fezReXGB2MSVAbu8NXHdlJ6vPr5ERlg7A0JFR9Knx
s8PoI/1hd73mwGld9/Xo3xByDbJ7Uejjt3HpNZf9eOq3XPp02dpKsOQEB2QxxPHI
TcBH8IBZY78BJHq9UD4g3fD904oIvs38BzvX/WAMO9W0k1ZLfF1zyR0+QXQweQAR
AQABiQJEBBgBAgAPAhsCBQJcRWq9BQkU+H0OASnAXSAEGQECAAYFAloCwr8ACgkQ
gEIvCiHZTet1zwf/TUmPpwnBgoA6AXILI5R/NvZit30mbExa6byBOK9vEbGS8pSu
L/GN5tzTmyJoGbLNc24h8w6FwcoxE0xJSUJKp7nO95NWD/kO5n8alJZN9ph8I2yt
Cl3dhzZKw8+j+WBwTrKLdDP5lfarI0gz6+N1UtFH4U+tUCq56DQqu46xyTS5ASeM
iO/8Ykej9LiObZv9QYwnKkhM8y+Dw9dkPfIsqt47uE4j4czpJ4qv8236oV/luR44
8cCud5G7ZGxBj6DSnitZM2lbq5yTlIZ3EEvu/I9dE/vsPaWQmGeo6S03FJ8+S6Xn
eP8mgYWl9YGJTjDvUg3FU9fXfHzCuFtZ/1YZvAkQ0LVfNZLADO2zEggAi3myJcVA
yiftlZSkTrId9LNeQtXCw7tkJcuaGIC/FWJQhVofcp2CuEAm26w9xRN39Tp7pi2r
fta/xykj0iYNjmqgi7MWK6pZOY/LCTEOMfYiWX4LCJ89f51y2TTmWwgfWXxFVe8y
lyRMC1N2CXEd5xsEKA1ZI5vF3ikjVkMBAtLGiSxcyBi8YbcDFG4/fTBNpeEvXZ6n
CusDDYCArwFiQi4mRtDbZXBZIBVE+jwYlzw0bz3EeqkPFMJ/pvuWeQ5R9LSuVYhh
aVieqoLXmK6uwQLoJOFx67KX+BoEPpkVa/FmDhfpguQrKz5/Eq1Lhy8P28EAhLSG
Ar1XuxedRos/pLkBDQRaAsFpAQgAm4sZiVbFI6YpR3yDFpe7qOkkWmlk+7MT8cAa
j5Ltm+mXqf7ZHDNeX9mzMNBZeoUBCztp0n/N0Iu5T7MmEJV/rrJa0N8ezjY9kDTX
xUmLRmXTM/AM7Jg6dsIOf/lrd2TAagUkf/nYS9Sxx7/MvWESis3uYw8aqpuXjS0t
FgaG3umvTfvgI2SamuZTkdt9KmoqKCFcf5qjNk7PeY0REVYUp0/mfyPDo7s33yOm
P0x9wy6zeZ4OKAsSETvARj8WafUT7vikVuZEtfiLolT741y2VtvyBICooLsVZ6Pf
MMle4newVhbZeJAjUTdxoE4T+B1vMICsbNw2/zsYtM/9KKvWpwARAQABiQElBBgB
AgAPAhsMBQJcRWqNBQkU+H5mAAoJENC1XzWSwAztix8IAN+/SZI+fr6AkLuC0X+0
FxpsSD3n89XQja+nTrVTODu2c1BDi0bXOMwcOyRqnnZ1F/tKieVQsfpvZoumF7Wi
fs9O3Mlt9Tw1b+g7tfnTj3a9GP6AiYzt/Zde2YGhbZ+65AOwka8DegWm+R6JuLds
y6oERH1BzGytG/c6pKY17XiMnXTdjwvN+YuSJ89eqA90KzoIOVCx9kWVagxzWh6u
WioiuAStwrUmZ+KOFhQbmXtEO+fUHf+G9J5DtlKFLHjz4Qy88z0jdGvE0Yf3r46q
d8mzOSlOX9N2LWTR+bFuN9DYeoQmDyibEM5W9dNH4Fn8F8wKyMgX33bz/ougs6+m
re0=
=Dl6i
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEEzf8af16GP0HJOpBzgEIvCiHZTesFAmJY2pQACgkQgEIvCiHZ
TeubLQf/RnOFOBnPZBe2BsKMIcUEILq2sfbGSejB4HuV0qEiJkiywhVqkFtWvjaj
54FWY9WEwJktC/MfOFLUy2/aqr4oN95hnx2+IVIeyZB7VLuL57rT1B36Q9tLqIo8
9TDoshfTc9spLujXsZmAt9Pc0yiz88dilExkhuocAUNgUAGt6hvZ6wmZm7UI4jtn
aV1vf5xTi5YpbIBuyd7Vu+sToCANAZJNiNWwptTtVSiqnpo5CvJrrnNJqzI8CMki
7tL8CGqlaQApEtm3kE6um/Kg+7cH5SZcPyioTRp1ibe+7uBJNzyaMr03EwkACuN9
LzsBlrbMOkqZE+o6IvZaP2rHfJKW6w==
=MIKv
-----END PGP SIGNATURE-----