Bugzilla Bug 214816

Firefox 2.0.0.13 is out, security fixes as usual.

2.0.0.13 fixes (among others) 2 critical vulnerabilities, see
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.13.

=www-client/mozilla-firefox[-bin]-2.0.0.13
=net-libs/xulrunner-1.8.1.13
=www-client/seamonkey[-bin]-1.1.9

in the tree

Arches, please test and mark stable:
=www-client/mozilla-firefox-2.0.0.13
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"

=www-client/mozilla-firefox-bin-2.0.0.13
Target keywords : "amd64 release x86"

=www-client/seamonkey-1.1.9
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"

=www-client/seamonkey-bin-1.1.9
Target keywords : "amd64 release x86"

=net-libs/xulrunner-1.8.1.13
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 release sparc x86"

Raul, please note that as long as it's not p.masked, xulrunner-bin also needs
to be upgraded.

amd64/x86 stable

(In reply to comment #4)
> Raul, please note that as long as it's not p.masked, xulrunner-bin also needs
> to be upgraded.

*xulrunner-bin-1.8.1.13 (26 Mar 2008)

  26 Mar 2008; Raúl Porcel <armin76@gentoo.org>
  xulrunner-bin-1.8.1.12.ebuild, +xulrunner-bin-1.8.1.13.ebuild:
  Version bump

alpha/ia64/sparc stable

ppc and ppc64 done

Description:
CVE-2008-1233 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1233):
  Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird
  before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to
  execute arbitrary code via "XPCNativeWrapper pollution."

CVE-2008-1234 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1234):
  Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.13,
  Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote
  attackers to inject arbitrary web script or HTML via event handlers, aka
  "Universal XSS using event handlers."

CVE-2008-1235 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1235):
  Unspecified vulnerability in Mozilla Firefox before 2.0.0.13, Thunderbird
  before 2.0.0.13, and SeaMonkey before 1.1.9 allows remote attackers to
  execute arbitrary code via unknown vectors that cause JavaaScript to execute
  with the wrong principal, aka "Privilege escalation via incorrect
principals."

CVE-2008-1236 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1236):
  Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13,
  Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote
  attackers to cause a denial of service (crash) and possibly execute arbitrary
  code via unknown vectors related to the layout engine.

CVE-2008-1237 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1237):
  Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.13,
  Thunderbird before 2.0.0.13, and SeaMonkey before 1.1.9 allow remote
  attackers to cause a denial of service (crash) and possibly execute arbitrary
  code via unknown vectors related to the JavaScript engine.

CVE-2008-1238 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1238):
  Mozilla Firefox before 2.0.0.13 and SeaMonkey before 1.1.9, when generating
  the HTTP Referer header, does not list the entire URL when it contains Basic
  Authentication credentials without a username, which makes it easier for
  remote attackers to bypass application protection mechanisms that rely on
  Referer headers, such as with some Cross-Site Request Forgery (CSRF)
  mechanisms.

CVE-2008-1241 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1241):
  GUI overlay vulnerability in Mozilla Firefox before 2.0.0.13 and SeaMonkey
  before 1.1.9 allows remote attackers to spoof form elements and redirect user
  inputs via a borderless XUL pop-up window from a background tab.

Marked stable for HPPA:
  =www-client/mozilla-firefox-2.0.0.13
  =net-libs/xulrunner-1.8.1.13
  =www-client/seamonkey-1.1.9

None of these passes the Acid3 test, btw. ;-)

Fixed in release snapshot.

GLSA is filed, waiting for Thunderbird :-/

*** Bug 219983 has been marked as a duplicate of this bug. ***

As pointed out in the duplicate (see comment 13), Thunderbird 2.0.0.14 has been
released.

mail-client/mozilla-thunderbird[-bin]-2.0.0.14 in the tree

Arches, please test and mark stable:
=mozilla-thunderbird-2.0.0.14
Target keywords: "alpha amd64 ia64 ppc ppc64 release sparc x86"

=mozilla-thunderbird-bin-2.0.0.14
Target keywords: "amd64 release x86"

CC-in archs for thunderbird stabilization.

amd64/x86 stable

alpha/ia64/sparc stable

ppc64 stable

ppc done

GLSA 200805-18, sorry for the delay