Firefox (Critical Security Updates)

ztroop

There are two zero days that were patched in 97.0.2 but the package manager is only showing 97.0.

CVE-2022-26485 – Removing an XSLT parameter during processing could lead to an exploitable use-after-free
CVE-2022-26486 – An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape

I know the update cycle is every Friday. However, I think waiting a week is not adequate for emerging security issues. How have others addressed this? Or is this just the way it is?

kyrios

ztroop The forum is a place to share and discuss with the Solus community.
Security issues must be reported on the Dev Tracker and mores specifically with the Report Security Issue link in the left navigation menu.

By the way Firefox 98.0 is already in unstable.

ztroop

The security issue is already published and public knowledge. I was hoping to discuss how Solus handles said security issues. Is there no security release channel? Is unstable the answer then? The only thing I can find is a blog post on how to switch from stable to unstable and I'm not even sure if that's up to date.

== Update ==

I found how to enable Unstable through this forum post.

brent

I don't know the place that Solus devs hang out "to discuss how Solus handles said security issues."
IRC maybe? Don't know. another afaik is there is a place to report security issues at dev tracker (link above), and they probably will respond to you there. CVE fixes are transparent at that same site

I don't personally think this is extreme enough to immediately uninstall firefox and install the unstable repo then install the new firefox. Friday updates will be here soon enough. 2 cents.

ztroop

brent I was looking for the process around releasing security updates, not the specifics of the vulnerability or disclosure. @Harvey answered that question.

Harvey

If people do not want to wait you can not just pull in Firefox 98.0 to stable using the method I am about to describe, it was built with a new version of llvm which is also not in stable and thus can not be satisfied this way and I do not recommend pulling it in.

Firefox 97.0.2 however can be pulled in without issue, I tested it personally.
sudo eopkg it https://packages.getsol.us/unstable/f/firefox/firefox-97.0.2-243-1-x86_64.eopkg

People should be aware that as a general rule pulling packages from unstable like this is not a good idea and can cause breakages (This time it'll be fine).

They should also know that if they switch their system to the unstable repository using the method linked to by the OP, Solus expects users on the unstable repository to be in our #solus-dev IRC channel which requires a registered account on https://libera.chat network in order to enter. These users must check the channel topic before updating to make sure it does not warn people that xyz is in progress / do not update. Be aware that the unstable repository is called unstable for a reason, you may encounter issues.

If you just update randomly while on the unstable repository you are likely to eventually catch it at the wrong time and cause breakages to your system. If you break your system by not adhering to this rule, we do not want to know about it and will not help you fix it.

ztroop

Harvey Perfect, thanks!

joluveba

Harvey Firefox 97.0.2 however can be pulled in without issue, I tested it personally.
sudo eopkg it https://packages.getsol.us/unstable/f/firefox/firefox-97.0.2-243-1-x86_64.eopkg

Thank you ztroop for bringing this issue to our attention, and thank you Harvey for solving it. I think that in cases like this one, an exception should be made, and the patch (97.0.2) should be available immediately on stable, not waiting for next Friday update. Or a post with the solution, like Harvey did. Again, thank you very much.

DataDrake

I've cherry-picked 97.0.2 to Shannon and it's available to everyone now.

In the future, please do NOT disclose security vulnerabilities in public spaces (@ztroop ). It doesn't matter if vulnerability is public or has left embargo, it increases risk to your fellow Solus users.

If you found out the front door to your apartment building was not locking, you'd report it to management and maybe put a note inside for residents to see. But you would not put a note outside for everyone to see.

Please use our Security form to report these issues: https://dev.getsol.us/maniphest/task/edit/form/3/

It can also be found on the front page of the bug tracker in the sidebar labelled Report Security Issue