[SOLVED] firefox-esr update

nogeek · 2019-06-20 22:32:02

There are two new Versions of firefox-esr because of two bugs one critical and one high:
https://www.mozilla.org/en-US/security/ … sa2019-18/
https://www.mozilla.org/en-US/security/ … sa2019-19/

But a apt update do not get me these versions.
Why?

It is not the first time I have to wait long time before I can upgrade firefox...
That is a high security risc, cause some people need to allow Javascript for banking or something else...

Last edited by nogeek (2019-06-23 03:41:15)

soohwa · 2019-06-20 23:19:12

Try the old repository :

deb http://auto.mirror.devuan.org/merged jessie main contrib non-free
deb http://auto.mirror.devuan.org/merged jessie-backports main contrib non-free
deb http://auto.mirror.devuan.org/merged jessie-updates main contrib non-free
deb http://auto.mirror.devuan.org/merged jessie-security main contrib non-free

deb http://auto.mirror.devuan.org/merged ascii main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-backports main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-updates main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-security main contrib non-free

Last edited by soohwa (2019-06-20 23:20:37)

golinux · 2019-06-20 23:24:18

OMG! Not another thread about this . . .

soohwa · 2019-06-20 23:31:22

I know, I know, sorry about that but it worked for me.
I really do not want to start a flameware but deb.devuan.org wasn't up-to-date ( about https://www.mozilla.org/en-US/security/ … sa2019-18/ ). Maybe it's the case now.

Last edited by soohwa (2019-06-20 23:35:01)

nogeek · 2019-06-20 23:31:31

soohwa wrote:

Try the old repository :

deb http://auto.mirror.devuan.org/merged ascii main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-backports main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-updates main contrib non-free
deb http://auto.mirror.devuan.org/merged ascii-security main contrib non-free

This mirror do not work with https, so I won't use it.

golinux wrote:

OMG! Not another thread about this . . .

Like wich ones before?

UPDATE:
The link did not work, it was search for the word 'firefox' in this forum

Seems like there is no up2date version of firefox in all branches:
https://pkginfo.devuan.org/cgi-bin/d1pk … elease=any
Or is this website out of date and if so why it exists?

BTW:
I am using this repo:
deb https://pkgmaster.devuan.org/merged ascii main
deb https://pkgmaster.devuan.org/merged ascii-security main
deb https://pkgmaster.devuan.org/merged ascii-updates main

Last edited by nogeek (2019-06-21 21:55:51)

nogeek · 2019-06-21 23:06:06

http://auto.mirror.devuan.org/merged
does not exist anymore, it redirects to
http://packages.roundr.devuan.org/merged
now.
I tried this http-only-shit after I tried all https-mirros from this list:
https://pkgmaster.devuan.org/mirror_list.txt
(btw:https://espejito.fder.edu.uy/devuan does not exist either...)

I runned

apt update -o Acquire::http::AllowRedirect=false

followed by

apt list --upgradable

and got

firefox-esr/stable-security 60.7.1esr-1~deb9u1 amd64 [upgradable from: 60.7.0esr-1~deb9u1]
vim-common/stable-security 2:8.0.0197-4+deb9u2 all [upgradable from: 2:8.0.0197-4+deb9u1]
vim-tiny/stable-security 2:8.0.0197-4+deb9u2 amd64 [upgradable from: 2:8.0.0197-4+deb9u1]
xxd/stable-security 2:8.0.0197-4+deb9u2 amd64 [upgradable from: 2:8.0.0197-4+deb9u1]

So no actual version of firefox either!
I am not an expert, but this is big crap!
I really need firefox, a safe one!

At least: I would never upgrade my system over http...

Last edited by nogeek (2019-06-21 23:10:10)

fsmithred · 2019-06-22 00:09:03

You found the newest version of firefox-esr that's in stretch/ascii. It's been there a few days. I expect it'll be no more than a few days before the second patch migrates down.
https://security-tracker.debian.org/tra … irefox-esr

There is no firefox in stretch or ascii. Never was, never will be.

Both firefox and firefox-esr are in the unstable branch (sid/ceres) and it looks like they've both been patched.
https://security-tracker.debian.org/tra … ge/firefox

If you need the latest version right away, you can always get it directly from mozilla and just unpack it and run it. That's a more conservative choice than upgrading to ceres.

pcalvert · 2019-06-22 00:45:56

I downloaded the Firefox ESR package from here:
https://packages.debian.org/stretch/firefox-esr

Then I installed it using gdebi.

Result:

$ apt policy firefox-esr
firefox-esr:
  Installed: 60.7.1esr-1~deb9u1
  Candidate: 60.7.1esr-1~deb9u1
  Version table:
 *** 60.7.1esr-1~deb9u1 100
        100 /var/lib/dpkg/status
     60.7.0esr-1~deb9u1 500
        500 http://deb.devuan.org/merged ascii-security/main i386 Packages
     60.6.3esr-1~deb9u1 500
        500 http://deb.devuan.org/merged ascii-updates/main i386 Packages
     60.6.1esr-1~deb9u1 500
        500 http://deb.devuan.org/merged ascii/main i386 Packages

Phil

nogeek · 2019-06-23 03:00:44

fsmithred wrote:

If you need the latest version right away, you can always get it directly from mozilla and just unpack it and run it. That's a more conservative choice than upgrading to ceres.

Hey, thanks for your answer.
Yeah I ment a package with the newest security patches (version was the wrong word sorry).
Before you posted this I have had it already downloaded from here:
https://releases.mozilla.org/pub/firefox/releases/

pcalvert wrote:

I downloaded the Firefox ESR package from here:
https://packages.debian.org/stretch/firefox-esr

I now this website, but this link is not the source where you have to download it from, it is here:
~~http://security.debian.org/debian-secur … ian.tar.xz~~
http://security.debian.org/debian-secur … _amd64.deb
and this is not https.

Last edited by nogeek (2019-06-23 15:16:53)

Head_on_a_Stick · 2019-06-23 09:16:07

nogeek wrote:

this is not https.

Why do you care if your ISP can see which packages you are downloading?

Try

wget https://deb.debian.org/debian-security/pool/updates/main/f/firefox-esr/firefox-esr_60.7.1esr-1~deb9u1_amd64.deb
# dpkg -i firefox-esr_60.7.1esr-1~deb9u1_amd64.deb

fsmithred · 2019-06-23 11:31:13

nogeek wrote:

pcalvert wrote:
I downloaded the Firefox ESR package from here:
https://packages.debian.org/stretch/firefox-esr
I now this website, but this link is not the source where you have to download it from, it is here:
http://security.debian.org/debian-secur … ian.tar.xz
and this is not https.

You just downloaded the source package, which you can use to compile new binaries. I can assure you that you do not want to do that. Try one of these .deb packages instead. You can find these by scrolling down the page that pcalvert linked and selecting the architecture you want.

amd64
http://security.debian.org/debian-secur … _amd64.deb

i386
http://security.debian.org/debian-secur … 1_i386.deb

nogeek · 2019-06-23 15:15:03

Head_on_a_Stick wrote:

Why do you care if your ISP can see which packages you are downloading?

https does not only pretend listening, it also pretends Man-in-the-Middle-Attacks.
And even if it only protects me from listening: my ISP do not need to know anything (data economy). ;-)

Head_on_a_Stick wrote:

Try

wget https://deb.debian.org/debian-security/pool/updates/main/f/firefox-esr/firefox-esr_60.7.1esr-1~deb9u1_amd64.deb
# dpkg -i firefox-esr_60.7.1esr-1~deb9u1_amd64.deb

If I would do this I would run:

torsocks wget --https-only --no-cookies foobar

But just as I say above it is not Firefox ESR 60.7.2.
https://www.mozilla.org/en-US/security/ … sa2019-19/

fsmithred wrote:

You just downloaded the source package, [..]

I just posted the wrong link (was tired) but thanks I will correct the other post ;-)

Thank you all for you posts and have a nice day! :-)

Last edited by nogeek (2019-06-23 22:21:56)

Head_on_a_Stick · 2019-06-24 16:11:12

v60.7.2 of firefox-esr has just been made available in the Devuan ceres repositories:

https://pkginfo.devuan.org/stage/ceres/ … esr-1.html

I presume it will filter down to the other branches soon.

Dutch_Master · 2019-06-24 16:58:36

Just installed the earlier version (60.7.1) on Ascii. Didn't show up yesterday though.

The officially official Devuan Forum!

#1 2019-06-20 22:32:02

[SOLVED] firefox-esr update

#2 2019-06-20 23:19:12

Re: [SOLVED] firefox-esr update

#3 2019-06-20 23:24:18

Re: [SOLVED] firefox-esr update

#4 2019-06-20 23:31:22

Re: [SOLVED] firefox-esr update

#5 2019-06-20 23:31:31

Re: [SOLVED] firefox-esr update

#6 2019-06-21 23:06:06

Re: [SOLVED] firefox-esr update

#7 2019-06-22 00:09:03

Re: [SOLVED] firefox-esr update

#8 2019-06-22 00:45:56

Re: [SOLVED] firefox-esr update

#9 2019-06-23 03:00:44

Re: [SOLVED] firefox-esr update

#10 2019-06-23 09:16:07

Re: [SOLVED] firefox-esr update

#11 2019-06-23 11:31:13

Re: [SOLVED] firefox-esr update

#12 2019-06-23 15:15:03

Re: [SOLVED] firefox-esr update

#13 2019-06-24 16:11:12

Re: [SOLVED] firefox-esr update

#14 2019-06-24 16:58:36

Re: [SOLVED] firefox-esr update

Board footer