LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
Search this Thread
Old 03-24-2010, 08:03 PM   #1
Maestro485
Member
 
Registered: Apr 2004
Location: Pittsburgh
Distribution: Slackware
Posts: 136

Rep: Reputation: 16
Slackware 13 and the recent Firefox vulnerability


As you might have heard, a recent critical vulnerability was discovered in Firefox 3.6.

Any word on a Slackware patch coming soon?

I'd prefer to use a Slackware package rather than the actual Mozilla release, but I also don't like browsing the web with a remote code execution bug in my browser.

Or is Slackware unaffected by this? Please correct me if I'm wrong.

Thanks,
Matt
 
Old 03-24-2010, 09:01 PM   #2
onebuck
Moderator
 
Registered: Jan 2005
Location: Midwest USA, Central Illinois
Distribution: SlackwareŽ
Posts: 11,445
Blog Entries: 4

Rep: Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505
Hi,

There is a security fix for Slackware 12.2 but that was for FF 3.05.

Quote:
Here are the details from the Slackware 12.2 ChangeLog:
+--------------------------+
Sat Mar 6 18:57:32 UTC 2010
patches/packages/mozilla-firefox-3.0.18-i686-1.tgz: Upgraded.
Upgraded to firefox-3.0.18.
This fixes some security issues.
For more information, see:
http://www.mozilla.org/security/know...firefox30.html
(* Security fix *)
+--------------------------+

You can look at ;http://www.mozilla.org/security/know...firefox36.html

I'm not aware of a FF security fix for 13 or -current.


EDIT: I don't see a 'remote code execution bug' at http://www.mozilla.org/security/know...firefox36.html

EDIT2: WOFF heap corruption due to integer overflow is the bug the OP is speaking of.

Last edited by onebuck; 03-24-2010 at 09:23 PM.
 
1 members found this post helpful.
Old 03-24-2010, 09:12 PM   #3
GazL
Senior Member
 
Registered: May 2008
Posts: 3,502

Rep: Reputation: 1024Reputation: 1024Reputation: 1024Reputation: 1024Reputation: 1024Reputation: 1024Reputation: 1024Reputation: 1024
It's this one Gary:

http://www.mozilla.org/security/anno...sa2010-08.html

And yes, it's quite nasty and has been out there for about a month.

The bug is in the parser for downloadable fonts, so I believe that going into about:config and changing gfx.downloadable_fonts.enable to false will help mitigate the risk until the team have had time to put a new package together.

I downloaded the sources and built my own 3.6.2 package yesterday as I didn't want to wait.

Last edited by GazL; 03-24-2010 at 09:16 PM.
 
1 members found this post helpful.
Old 03-24-2010, 09:19 PM   #4
onebuck
Moderator
 
Registered: Jan 2005
Location: Midwest USA, Central Illinois
Distribution: SlackwareŽ
Posts: 11,445
Blog Entries: 4

Rep: Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505Reputation: 1505
Hi,

Thanks!

I wasn't aware of it. I just looked at the changelogs but did not notice a problem.

Again thanks for the link, heads up and temporary fix.

 
Old 03-24-2010, 09:32 PM   #5
Maestro485
Member
 
Registered: Apr 2004
Location: Pittsburgh
Distribution: Slackware
Posts: 136

Original Poster
Rep: Reputation: 16
Thanks a lot for the suggestions! Hopefully they can get a patch out soon.
 
Old 03-25-2010, 12:09 AM   #6
MannyNix
Member
 
Registered: Dec 2005
Location: ~
Distribution: Slackware -current, OpenBSD
Posts: 449

Rep: Reputation: 41
Quote:
Originally Posted by GazL View Post
I downloaded the sources and built my own 3.6.2 package yesterday as I didn't want to wait.
This type of freedom and simplicity is why I like Slackware so much.
 
Old 03-25-2010, 01:14 AM   #7
slowpoke
Member
 
Registered: Feb 2010
Posts: 33

Rep: Reputation: 15
Where would I find a Slackbuild for FireFox?
 
Old 03-25-2010, 01:21 AM   #8
astrogeek
Senior Member
 
Registered: Oct 2008
Distribution: Slackware [64]X{.0|.1|.2|-current} ::X>=12<=14, FreeBSD_10{.0|.1}
Posts: 2,155

Rep: Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848
Quote:
Originally Posted by slowpoke View Post
Where would I find a Slackbuild for FireFox?
source/xap/mozilla-firefox/mozilla-firefox.SlackBuild
 
Old 03-25-2010, 01:27 AM   #9
slowpoke
Member
 
Registered: Feb 2010
Posts: 33

Rep: Reputation: 15
Thanks!
 
Old 03-25-2010, 01:34 AM   #10
MannyNix
Member
 
Registered: Dec 2005
Location: ~
Distribution: Slackware -current, OpenBSD
Posts: 449

Rep: Reputation: 41
Quote:
Originally Posted by slowpoke View Post
Where would I find a Slackbuild for FireFox?
On almost any Slackware mirror on the /source/xap/mozilla-firefox/ dir

Depending on your Slackware version, here's a starting point

(Your mileage may vary, I'm running -current and it runs great, but it's up to you make sure it will work with the version you're running. You should have at least a minimal understanding of the way a Slackbuild works. Sbo is a different proyect (No support for this particular unofficial customization) but their How-To may help getting started using slackbuilds.
Good luck!
 
Old 03-25-2010, 09:56 AM   #11
slowpoke
Member
 
Registered: Feb 2010
Posts: 33

Rep: Reputation: 15
Found it.
Thanks!
 
Old 03-31-2010, 07:39 AM   #12
mutexe
Member
 
Registered: May 2009
Location: Malvern, UK
Distribution: Slackware 13.0
Posts: 225

Rep: Reputation: 32
Sorry to hijack thread, but:
Code:
ARCH=${ARCH:-i686}
Does this mean the slackbuild wont work on my 32 bit machine? Could i just change the numbers? Also, do slackbuilds effectively do the compiling and installing for you? I wanna have go at compiling something, just a bit nervous.

Once again sorry for the hijack, but i am trying to get FF 3.6.2 and this seems like a very relevant thread.

Cheers,
Tom
 
Old 03-31-2010, 07:44 AM   #13
brianL
LQ 5k Club
 
Registered: Jan 2006
Location: Oldham, Lancs, England
Distribution: Slackware & Slackware64 14.1
Posts: 7,134
Blog Entries: 52

Rep: Reputation: Disabled
It should work. What processor have you got? Post the results of uname -a.
 
Old 03-31-2010, 07:57 AM   #14
mutexe
Member
 
Registered: May 2009
Location: Malvern, UK
Distribution: Slackware 13.0
Posts: 225

Rep: Reputation: 32
Super fast reply. Cheers, i'll post output when i get home from work tonight!

Thanks again,
Tom
 
Old 03-31-2010, 12:49 PM   #15
Lufbery
Senior Member
 
Registered: Aug 2006
Location: Harrisburg, PA
Distribution: Slackware 64 14.0
Posts: 1,142
Blog Entries: 29

Rep: Reputation: 119Reputation: 119
Hi all,

While it is possible (and frankly easy) to roll my own updated Firefox using a new source file and the SlackBuild script in the sources, it would be nice to have an official update.

Has anyone had any word?

Regards,
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
LXer: Mozilla confirms critical vulnerability in Firefox 3.5 LXer Syndicated Linux News 0 07-15-2009 07:00 PM
LXer: Password vulnerability in Firefox 2.0.0.5 LXer Syndicated Linux News 2 07-23-2007 05:41 PM
Vulnerability in Firefox 1.0.4 / Mozilla 1.7.8 win32sux Linux - Security 24 09-09-2005 05:23 PM
Firefox/Javascript security vulnerability...... BajaNick General 2 04-12-2005 10:22 AM
downloading fix for recent security vulnerability - RH v2.1 AS joeslazenger Linux - Security 1 12-03-2003 03:24 PM


All times are GMT -5. The time now is 07:02 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration