It's mozilla patch-day!

Thursday, August 3. 2006

Posted by asac (Alexander Sack) in Debian OS, Debian Thunderbird at 13:00 | Comment (1) | Trackbacks (0)

... I have backported security fixes recently announced by mozilla for firefox and thunderbird to the old branch – which we have in debian stable.

You can grab the patchset I produced from http://people.debian.org/~asac/patchset_109b.tar.gz.

In it you find patches that fix:

all security flaws whose security advisories had been announced together with firefox/thunderbird 1.5.0.5 – if applicable
a tricky issue that had not been fixed in the last debian stable-security update for mozilla, mozilla-firefox and mozilla-thunderbird (aka mfsa2006-32, Part 2/7).
two regressions introduced in our last stable-security update that broke some extensions.

Good news is that a bunch of critical flaws have been identified to not affect debian stable, namely:

CODE:

  + CVE-2006-3801, MFSA 2006-44
  + CVE-2006-3677, MFSA 2006-45
  + CVE-2006-3113, MFSA 2006-46
  + CVE-2006-3802, MFSA 2006-47
  + CVE-2006-3803, MFSA 2006-48
  + CVE-2006-3804, MFSA 2006-49
  + CVE-2006-3810, MFSA 2006-54
  + CVE-2006-3812, MFSA 2006-56

Another good news is that MFSA2006-45 – which was recently /.ed with a working exploit – is in that list too. So debian stable users are not affected by that issue.

In order to get feedback and testing I am now preparing packages. Testing this is critical, because upstream has abandoned 1.0.x development. So please help to test and report regressions … otherwise those might go unseen and finally slip through to our users. I will announce new packages available for testing on my site and on the pkg-mozilla-maintainers mailing-list.

Thanks for your support!

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Thanks!

#1 Thomas (Homepage) on 2006-08-03 13:55 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above: BBCode format allowed Enclosing asterisks marks text as bold (word), underscore are made via _word_. Textile-formatting allowed Standard emoticons like :-) and ;-) are converted to images.
	Remember Information? Subscribe to this entry