Bug 214816 - mozilla-firefox <2.0.0.13, mozilla-thunderbird <2.0.0.14, seamonkey <1.1.9, xulrunner <1.8.1.13 Multiple vulnerabilites (CVE-2007-4879, CVE-2008-{1233,1234,1235,1236,1237,1238,1240,1241})
|
Bug#:
214816
|
Product: Gentoo Security
|
Version: unspecified
|
Platform: All
|
|
OS/Version: Linux
|
Status: RESOLVED
|
Severity: normal
|
Priority: P2
|
|
Resolution: FIXED
|
Assigned To: security@gentoo.org
|
Reported By: rbu@gentoo.org
|
|
Component: Vulnerabilities
|
|
|
URL:
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.13
|
|
Summary: mozilla-firefox <2.0.0.13, mozilla-thunderbird <2.0.0.14, seamonkey <1.1.9, xulrunner <1.8.1.13 Multiple vulnerabilites (CVE-2007-4879, CVE-2008-{1233,1234,1235,1236,1237,1238,1240,1241})
|
|
Keywords:
|
|
Status Whiteboard: A2 [glsa]
|
|
Opened: 2008-03-26 01:51 0000
|
Firefox 2.0.0.13 is out, security fixes as usual.
=www-client/mozilla-firefox[-bin]-2.0.0.13
=net-libs/xulrunner-1.8.1.13
=www-client/seamonkey[-bin]-1.1.9
in the tree
Arches, please test and mark stable:
=www-client/mozilla-firefox-2.0.0.13
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"
=www-client/mozilla-firefox-bin-2.0.0.13
Target keywords : "amd64 release x86"
=www-client/seamonkey-1.1.9
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"
=www-client/seamonkey-bin-1.1.9
Target keywords : "amd64 release x86"
=net-libs/xulrunner-1.8.1.13
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"
Raul, please note that as long as it's not p.masked, xulrunner-bin also needs
to be upgraded.
(In reply to comment #4)
> Raul, please note that as long as it's not p.masked, xulrunner-bin also needs
> to be upgraded.
*xulrunner-bin-1.8.1.13 (26 Mar 2008)
26 Mar 2008; Raúl Porcel <armin76@gentoo.org>
xulrunner-bin-1.8.1.12.ebuild, +xulrunner-bin-1.8.1.13.ebuild:
Version bump
Description:
CVE-2008-1233 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1233):
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird
before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to
execute arbitrary code via "XPCNativeWrapper pollution."
CVE-2008-1234 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1234):
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13,
Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote
attackers to inject arbitrary web script or HTML via event handlers, aka
"Universal XSS using event handlers."
CVE-2008-1235 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1235):
Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird
before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to
execute arbitrary code via unknown vectors that cause JavaaScript to execute
with the wrong principal, aka "Privilege escalation via incorrect
principals."
CVE-2008-1236 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1236):
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13,
Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote
attackers to cause a denial of service (crash) and possibly execute arbitrary
code via unknown vectors related to the layout engine.
CVE-2008-1237 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1237):
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13,
Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote
attackers to cause a denial of service (crash) and possibly execute arbitrary
code via unknown vectors related to the JavaScript engine.
CVE-2008-1238 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1238):
Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating
the HTTP Referer header, does not list the entire URL when it contains Basic
Authentication credentials without a username, which makes it easier for
remote attackers to bypass application protection mechanisms that rely on
Referer headers, such as with some Cross-Site Request Forgery (CSRF)
mechanisms.
CVE-2008-1241 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1241):
GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey
before 1.1.9 allows remote attackers to spoof form elements and redirect user
inputs via a borderless XUL pop-up window from a background tab.
Marked stable for HPPA:
=www-client/mozilla-firefox-2.0.0.13
=net-libs/xulrunner-1.8.1.13
=www-client/seamonkey-1.1.9
None of these passes the Acid3 test, btw. ;-)
Fixed in release snapshot.
GLSA is filed, waiting for Thunderbird :-/
*** Bug 219983 has been marked as a duplicate of this bug. ***
As pointed out in the duplicate (see comment 13), Thunderbird 2.0.0.14 has been
released.
mail-client/mozilla-thunderbird[-bin]-2.0.0.14 in the tree
Arches, please test and mark stable:
=mozilla-thunderbird-2.0.0.14
Target keywords: "alpha amd64 ia64 ppc ppc64 release sparc x86"
=mozilla-thunderbird-bin-2.0.0.14
Target keywords: "amd64 release x86"
CC-in archs for thunderbird stabilization.
GLSA 200805-18, sorry for the delay
