2

I have Xubuntu 16.04 and I was using Firefox as a regular user. I update Firefox with Synaptic each time. But with the release of Firefox 57, my old Firefox was automatically updated to this new Firefox 57 without my consent. I checked /usr/bin/firefox modification date, and it was modified just a day ago.

My question is: Is Firefox automatic update system-wide abusing root privileges? If so, isn't this a security risk, and why would Linux allow it?

Thanks for any hints.

4

Ubuntu is by standard set up for unattended upgrades for security patches and updates. Since Firefox 57 was released through the security repositories you might feel it is abusing root rights, but in fact it isn't, it just got installed through unattended upgrades.

$ apt policy firefox
firefox:
  Installed: 57.0.1+build2-0ubuntu0.17.10.1
  Candidate: 57.0.1+build2-0ubuntu0.17.10.1
  Version table:
 *** 57.0.1+build2-0ubuntu0.17.10.1 500
        500 http://archive.ubuntu.com/ubuntu artful-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu artful-security/main amd64 Packages
     56.0+build6-0ubuntu1 500
        500 http://archive.ubuntu.com/ubuntu artful/main amd64 Packages
        100 /var/lib/dpkg/status

If you want to verify that you simply can have a look at /var/log/apt/history.log and search for the updates that happened recently. On its own Firefox on Linux is unable to update itself like it does on Windows.

You could have put Firefox on hold beforehand but now as you have been upgraded already to the newest version you should look into ways to downgrade it or alternatives

  • I see. Thank you very much for clarifying the issue! – lisprogtor Dec 6 '17 at 5:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.