CVE-2019-11712 · cross-distro fix matrix

CVE-2019-11712: POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery (CSRF) attacks. This vulnerability affects Firefox ESR < 60.8, Firefox < 68, and Thunderbird < 60.8.

Affects 8 Linux releases across 11 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2019-11712 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

firefox-esr→ fixed in60.8.0esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
thunderbird→ fixed in1:60.8.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in60.8.0esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
thunderbird→ fixed in1:60.8.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```

Source: Debian Security Tracker

firefox-esr→ fixed in60.8.0esr-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y firefox-esr
```
thunderbird→ fixed in1:60.8.0-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y thunderbird
```