Important information about critical security updates in BLFS (2025-03-07)

Good evening everyone,

I was hoping we'd go a week or two without one of these :) this edition 
of the security update bulletin includes updates for the following packages:

- vim

- Spidermonkey

- Firefox

- Thunderbird

I'd like to start this off with a couple of disclaimers. The vim 
vulnerability does **not** affect 12.3, as it was updated to fix the 
vulnerability right before we released LFS 12.3. If you are using LFS 
12.3, you are **not** affected by that vulnerability. I'd like to also 
note that while most security updates made will still work on LFS/BLFS 
12.2 systems, users who encounter issues should report them to us as the 
system I personally test security updates on will soon be updated to 
BLFS 12.3. If there is an issue with a security update applying on older 
systems, we may consider documenting it in the advisory depending on how 
severe the problem is! Someone will likely need to bring it to our 
attention though.

Let's first talk about vim. In vim-9.1.1166, a security vulnerability 
was fixed that allows for arbitrary code execution while viewing a 
crafted tar file in vim. Amongst the editors at least, that feature gets 
used constantly to view changelogs without having to untar files to get 
access to the file, but users might use it for similar purposes. The 
vulnerability itself exists in the tar.vim plugin, and it occurs because 
the plugin uses ":read <filename>" without sanitizing <filename>, and 
now has documented evidence of allowing for execution of shell commands. 
Because of the potential for supply chain attacks, it's highly 
recommended that all LFS and BLFS users who use this functionality 
update to vim-9.1.1166 as soon as possible. Please note that only users 
of LFS 12.2 and older are impacted as we updated the package within a 
couple of days before the release of LFS 12.3. Thank you also to Joe 
Locash, who brought the vulnerability to our attention in the LFS ticket 
for updating vim.

Next up is Spidermonkey. Spidermonkey is Firefox's JavaScript engine, 
and while there aren't vulnerabilities discovered in it very often, 
there were a couple found before Firefox 128.8.0esr was released. The 
two vulnerabilities allow for arbitrary code execution. The first one 
occurs due to type confusion, and the other one happens due to 
unexpected garbage collection. The type confusion vulnerability occurs 
due to JIT corruption of WASM i32 values, where they can pick up bits 
from leftover memory and get treated as a different type. This 
vulnerability only impacts 64-bit CPUs, users of 32-bit versions of 
Spidermonkey are not impacted. The garbage collection vulnerability can 
also cause inconsistent results as well as crashes, so updating 
Spidermonkey to 128.8.0esr is recommended (especially if you are on a 
64-bit CPU, which most users are!)

The updates for Firefox and Thunderbird fix the exact same 
vulnerabilities, so I'm going to mention them both together. This update 
is classified as Critical by upstream due to a vulnerability being 
exploited in the wild, which allows for remote code execution with no 
user interaction. That particular vulnerability has also been documented 
to cause privilege escalation on some platforms. In total there were 9 
vulnerabilities fixed though, which allow for remote code execution, 
remotely exploitable crashes, arbitrary code execution, clickjacking, 
and for web extensions to be disguised as different elements on web 
pages (such as images)! Because of the severity of these 
vulnerabilities, especially the Critical remote execution vulnerability, 
we recommend that all users of Firefox and Thunderbird update both of 
these packages to 128.8.0esr immediately.

- Doug

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page