Bugzilla Bug 98855

Thunderbird 1.0.5 will fix the following vulnerability :
MFSA 2005-46  XBL scripts ran even when Javascript disabled

1.0.5 released, mozilla please bump.  
 
Note there is still no entry the security page: 
http://www.mozilla.org/projects/security/known-vulnerabilities.html 

Fixed in TB 1.0.5 :

MFSA 2005-56 Code execution through shared function objects
MFSA 2005-55 XHTML node spoofing
MFSA 2005-52 Same origin violation: frame calling top.focus()
MFSA 2005-50 Possibly exploitable crash in InstallVersion.compareTo()
MFSA 2005-46 XBL scripts ran even when Javascript disabled
MFSA 2005-44 Privilege escalation via non-DOM property overrides
MFSA 2005-41 Privilege escalation via DOM property overrides
MFSA 2005-40 Missing Install object instance checks
MFSA 2005-33 Javascript "lambda" replace exposes memory contents

mail-client/thunderbird{-bin}: 1.0.5 are in the tree.

Thx Anarchy, arches please test and mark stable :

mozilla-thunderbird target KEYWORDS="alpha amd64 ia64 ppc sparc x86"
mozilla-thunderbird-bin target KEYWORDS="~amd64 x86"

Hold the stable please it is still masked until Aron looks at it and makes a
call on enigmail support. Sorry I should have announced it when I put it up that
they were in the tree.

Waiting for a more definitive ebuild for TB.
x86 can still test TB-bin though.

i guess amd64 too, right? :)

Aight we have made our finall changes to thunderbird-1.0.5 we can go ahead with
marking stable.

Calling back arches...
Anarchy will test for ppc.

blubb: TB-bin is ~amd64 so you don't really need to mark it stable... But you
need to mark TB-not-bin amd64 :)

*** Bug 99031 has been marked as a duplicate of this bug. ***

PPC is stable you will need to stabilize mozilla-launcher 0.34 before you can
stablize thunderbird this is fine. Aron and Myself has already discussed this
and do not see any problems.

I was actually thinking of marking the -bin stable on amd64 as it works very
well. I've already tested the 1.0.5 ond amd64 but i needed that a non ~amd64
user would test and report.

I can do the amd64 -bin stable test in about 4 hours when i'm home.

sparc stable.
amd64 thunderbird-bin works fine here too (not keywording though since i'm not
on amd64@/authorized/whatever).

-bin stable on amd64

Stable on alpha and ia64.

x86, amd64: please test and mark thunderbird and thunderbird-bin stable
(thunderbird-bin is already done for amd64)

Hmm. Apparently 1.0.5 is quite broken, 1.0.6 should appear early next week.
http://www.mozillazine.org/talkback.html?article=6950

So I would say, stop the stable marking... and waiting for upstream

I've been running thunderbird (non-bin, 64-bit-compiled) on amd64 for about 24
hours now without issue.

Oddly enough enigmail seems to be working fine - even though it seems like there
are complaints that it shouldn't.  Enigmail is installed as a user-profile
extension (ie not system-wide).

mad64 please mark stable as soon as possible I will handle x86 if noone marks
it
by tonight. Enigmail is  NOT suppose to work with thunderbird 1.0.5 but it does
so I do not see this as an issue.

Stable on amd64.

both stable

GLSA 200507-17