Tuesday, September 27. 2005

Posted by asac (Alexander Sack) in Debian OS at 12:25 | Comments (0) | Trackbacks (0)

[Security Preview] mozilla 1.7.8-1sarge3 fixes various security bugs

Just uploaded mozilla 1.7.8-1sarge3 to my This package should address all currently disclosed issues. Please provide feedback if you encounter any regressions. Beside plain mozilla its important to test depending apps like galeon, kazehakase too.

Here the hunk from the changelog that gives you a brief overview of issues addressed with this upload:

CODE:

mozilla (2:1.7.8-1sarge3) stable-security; urgency=critical
   + MFSA-2005-56a.debian: Regressions introduced by mozilla 1.7.9.
     Summary: Regressions introduced by mozilla 1.7.9 bugfix. There was no
              advisory for it (debian/patches/001_mfsa_2005-56a.patch)
     Closes: 321427
     Bugzilla: 294307 301917 300749
     Issues addressed:
       + Regressions introduced by mozilla 1.7.9 bugfix.
   + MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
             name consisting solely of soft-hyphen characters.
             (debian/patches/001_mfsa-2005-57.patch)
     Closes: 327366
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259 308281
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   + MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
             of ”critical” have been released in Mozilla Firefox 1.0.7 and
             the Mozilla Suite 1.7.12 (debian/patches/001_mfsa-2005-58.patch)
     Closes: 329778
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
             CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
              306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing
       + CAN-2005-2702 - Crash on ”zero-width non-joiner” sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   + MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
             are not correctly protected against interpretation by the
             shell. As a result a malicious URL can result in the execution
             of shell commands with the privileges of the user. If Firefox
             is set as the default handler for web URLs then opening a URL
             in another program (for example, links in a mail or chat
             client) can result in shell command execution.
             (debian/patches/001_mfsa-2005-59.patch)
     Closes: -
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution

Edit: You can get this package from my security preview archives. See http://www.asoftsite.org/apt-archives.html for the lines you need to apt-get this package.

Saturday, September 24. 2005

Posted by asac (Alexander Sack) in Debian OS at 22:58 | Comments (3) | Trackbacks (0)

[Security Preview] Firefox 1.0.4-2sarge4 fixes various security bugs

I uploaded a firefox package that should address all currently disclosed issues. Please provide feedback if you encounter any regressions. Otherwise, this package will be pushed to the debian security mirrors.

Here the hunk from the changelog that gives you a brief overview of issues addressed with this upload:

CODE:

mozilla-firefox (1.0.4-2sarge4) stable-security; urgency=critical

   + MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
      name consisting solely of soft-hyphen characters.
     Closes: 327452
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun

   + MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
      of ”critical” have been released in Mozilla Firefox 1.0.7 and
      the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
      CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
       306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing
       + CAN-2005-2702 - Crash on ”zero-width non-joiner” sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes

   + MFSA-2005-59: Debian Firefox is not affected by this.

Edit: You can get this package from my security preview archives. See http://www.asoftsite.org/apt-archives.html for the lines you need to apt-get this package.

Tuesday, September 20. 2005

Posted by asac (Alexander Sack) in Debian Sunbird at 01:24 | Comments (2) | Trackbacks (0)

[Preview Release] Sunbird 0.3 alpha package for debian

I uploaded a new version of sunbird to my archives. Actually, its some 0.3 alpha preview release, if you want to have a name. I took a cvs snapshot on Sep 17, 2005 for that purpose.

First, the good news:
I am uploading sunbird to my stable archive in a move to honour the good amount of work done by sunbird developers and the progress made in general usability and stability of sunbird. Read the blog entry http://www.babylonsounds.com/2005/09/sunbirdcalendar-progress-report.html to get some detailed infos on what has been achieved in recent history.

For those not willing to read the full story here the most important points:

improved localization capabilities
various improvements and fixes for the handling of recurring events
improved task handling with lots of bug fixes
improved multi calendar handling

Second, some bad news:
When will this release go into the debian archive? I can’t tell. I guess I have to find a free logo for sunbird first. So contributions or ideas for a good alternative are welcome.

For now, I uploaded sunbird to my stable archive only. As soon as I get to it, I will build it for sid too. That package will go into my experimental archives. My apt lines for all repositories are available from http://www.asoftsite.org/apt-archives.html.