- new upstream version (46.0.1) - fixed focus on TWM (rhbz#1322626) ---- - Fixed wrong keyboard focus (rhbz#1322626) ---- - New upstream version (46.0) - Fixed aarch64/ppc64le build failures - Fixed missing addons/langpacks. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-e2acbd739f 2016-05-07 11:02:29.656231 -------------------------------------------------------------------------------- Name : firefox Product : Fedora 22 Version : 46.0.1 Release : 1.fc22 URL : https://www.firefox.com/en-US/?redirect_source=mozilla-org Summary : Mozilla Firefox Web browser Description : Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. -------------------------------------------------------------------------------- Update Information: - new upstream version (46.0.1) - fixed focus on TWM (rhbz#1322626) ---- - Fixed wrong keyboard focus (rhbz#1322626) ---- - New upstream version (46.0) - Fixed aarch64/ppc64le build failures - Fixed missing addons/langpacks -------------------------------------------------------------------------------- References: [ 1 ] Bug #1322626 - [XINPUT2] Cannot type into any window other than most recently opened window in firefox using twm https://bugzilla.redhat.com/show_bug.cgi?id=1322626 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update firefox' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailinglist
A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201201-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: X.Org X Server/X Keyboard Configuration Database: Screen lock bypass Date: January 27, 2012 Bugs: #399347 ID: 201201-16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A debugging functionality in the X.Org X Server that is bound to a hotkey by default can be used by local attackers to circumvent screen locking utilities. Background ========= The X Keyboard Configuration Database provides keyboard configuration for various X server implementations. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-misc/xkeyboard-config < 2.4.1-r3 > = 2.4.1-r3 ------------------------------------------------------------------- # Package 1 only applies to users of these architectures: amd64, arm, hppa, x86 Description ========== Starting with the =x11-base/xorg-server-1.11 package, the X.Org X Server again provides debugging functionality that can be used terminate an application that exclusively grabs mouse and keyboard input, like screen locking utilities. Gu1 reported that the X Keyboard Configuration Database maps this functionality by default to the Ctrl+Alt+Numpad * key combination. Impact ===== A physically proximate attacker couldexploit this vulnerability to gain access to a locked X session without providing the correct credentials. Workaround ========= Downgrade to any version of x11-base/xorg-server below x11-base/xorg-server-1.11: # emerge --oneshot --verbose " =x11-misc/xkeyboard-config-2.4.1-r3" NOTE: The X.Org X Server 1.11 was only stable on the AMD64, ARM, HPPA, and x86 architectures. Users of the stable branches of all other architectures are not affected and will be directly provided with a fixed X Keyboard Configuration Database version. References ========= [ 1 ] CVE-2012-0064 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0064 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201201-16 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Get the latest Linux and open source security news straight to your inbox.