CVE-2018-5146 · cross-distro fix matrix

CVE-2018-5146: An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7.

Affects 8 Linux releases across 14 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2018-5146 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

firefox-esr→ fixed in52.7.2esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libvorbis→ fixed in1.3.5-4.2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvorbis
```
thunderbird→ fixed in1:52.7.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in52.7.2esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libvorbis→ fixed in1.3.5-4.2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvorbis
```
thunderbird→ fixed in1:52.7.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in52.7.2esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
libvorbis→ fixed in1.3.5-4.2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y libvorbis
```
thunderbird→ fixed in1:52.7.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```