MFSA 2008-45 XBM image uninitialized memory reading MFSA 2008-44 resource: traversal vulnerabilities MFSA 2008-43 BOM characters stripped from JavaScript before execution MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17) MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution MFSA 2008-40 Forced mouse drag MFSA 2008-39 Privilege escalation using feed preview page and XSS flaw MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation MFSA 2008-37 UTF-8 URL stack buffer overflow
Updates we're targeting: Firefox 3.0.2 Firefox 2.0.0.17 Thunderbird 2.0.0.17 SeaMonkey 1.1.12
*** Bug 238543 has been marked as a duplicate of this bug. ***
In the tree: www-client/mozilla-firefox[-bin]-2.0.0.17 www-client/seamonkey[-bin]-1.1.12 net-libs/xulrunner-1.8.1.17 Need to do xulrunner-bin and mozilla-thunderbird-2.0.0.17 needs to be released, which is scheduled for tomorrow, but since they release it at night on european time, i'll do it the 26th. *IF* they release it...
Arches, please test and mark stable: =www-client/mozilla-firefox-2.0.0.17 =www-client/seamonkey-1.1.12 =net-libs/xulrunner-1.8.1.17 Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 sparc x86" =www-client/mozilla-firefox-bin-2.0.0.17 =www-client/seamonkey-bin-1.1.12 Target keywords : "amd64 x86"
and =net-libs/xulrunner-bin-1.8.1.17 Target keywords : "amd64 x86"
ppc and ppc64 lovin' done
and =mail-client/mozilla-thunderbird-2.0.0.17 =x11-plugins/enigmail-0.95.7-r1 Target keywords : "alpha amd64 ia64 ppc ppc64 sparc x86 ~x86-fbsd" =mail-client/mozilla-thunderbird-bin-2.0.0.17 Target keywords : "amd64 x86"
CVE-2008-0016 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-0016): Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a crafted UTF-8 URL in a link. CVE-2008-3835 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3835): The nsXMLDocument::OnChannelRedirect function in Mozilla Firefox before 2.0.0.17, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code via unknown vectors. CVE-2008-3836 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3836): feedWriter in Mozilla Firefox before 2.0.0.17 allows remote attackers to execute scripts with chrome privileges via vectors related to feed preview and the (1) elem.doCommand, (2) elem.dispatchEvent, (3) _setTitleText, (4) _setTitleImage, and (5) _initSubscriptionUI functions. CVE-2008-3837 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3837): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, and SeaMonkey before 1.1.12, allow user-assisted remote attackers to move a window during a mouse click, and possibly force a file download or unspecified other drag-and-drop action, via a crafted onmousedown action that calls window.moveBy, a variant of CVE-2003-0823. CVE-2008-4058 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4058): The XPConnect component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to (1) chrome XBL and (2) chrome JS. CVE-2008-4059 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4059): The XPConnect component in Mozilla Firefox before 2.0.0.17 allows remote attackers to "pollute XPCNativeWrappers" and execute arbitrary code with chrome privileges via vectors related to a SCRIPT element. CVE-2008-4060 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4060): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to create documents that lack script-handling objects, and execute arbitrary code with chrome privileges, via vectors related to (1) the document.loadBindingDocument function and (2) XSLT. CVE-2008-4061 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4061): Integer overflow in the MathML component in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via an mtd element with a large integer value in the rowspan attribute, related to the layout engine. CVE-2008-4062 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4062): Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the JavaScript engine and (1) misinterpretation of the characteristics of Namespace and QName in jsxml.c, (2) misuse of signed integers in the nsEscapeCount function in nsEscape.cpp, and (3) interaction of JavaScript garbage collection with certain use of an NPObject in the nsNPObjWrapper::GetNewOrUsed function in nsJSNPRuntime.cpp. CVE-2008-4063 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4063): Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the layout engine and (1) a zero value of the "this" variable in the nsContentList::Item function; (2) interaction of the indic IME extension, a Hindi language selection, and the "g" character; and (3) interaction of the nsFrameList::SortByContentOrder function with a certain insufficient protection of inline frames. CVE-2008-4064 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4064): Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.2 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to graphics rendering and (1) handling of a long alert messagebox in the cairo_surface_set_device_offset function, (2) integer overflows when handling animated PNG data in the info_callback function in nsPNGDecoder.cpp, and (3) an integer overflow when handling SVG data in the nsSVGFEGaussianBlurElement::SetupPredivide function in nsSVGFilters.cpp. CVE-2008-4065 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4065): Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allow remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via byte order mark (BOM) characters that are removed from JavaScript code before execution, aka "Stripped BOM characters bug." CVE-2008-4066 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4066): Mozilla Firefox 2.0.0.14, and other versions before 2.0.0.17, allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms and conduct XSS attacks via HTML-escaped low surrogate characters that are ignored by the HTML parser, as demonstrated by a "jav?ascript" sequence, aka "HTML escaped low surrogates bug." CVE-2008-4067 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4067): Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 on Linux allows remote attackers to read arbitrary files via a .. (dot dot) and URL-encoded / (slash) characters in a resource: URI. CVE-2008-4068 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4068): Directory traversal vulnerability in Mozilla Firefox before 2.0.0.17 and 3.x before 3.0.2, Thunderbird before 2.0.0.17, and SeaMonkey before 1.1.12 allows remote attackers to bypass "restrictions imposed on local HTML files," and obtain sensitive information and prompt users to write this information into a file, via directory traversal sequences in a resource: URI. CVE-2008-4069 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4069): The XBM decoder in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to read uninitialized memory, and possibly obtain sensitive information in opportunistic circumstances, via a crafted XBM image file.
ppc and ppc64 done
Btw, ffox 3.0.3 was just released to replace 3.0.2
Stable for HPPA: =www-client/mozilla-firefox-2.0.0.17 =www-client/seamonkey-1.1.12 =net-libs/xulrunner-1.8.1.17
alpha/arm/ia64/sparc/x86 stable
amd64 stable, all arches done.
Request filed.
CVE-2008-4070 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-4070): Heap-based buffer overflow in Mozilla Thunderbird before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long header in a news article, related to "canceling [a] newsgroup message" and "cancelled newsgroup messages."
mozilla has nothing to do here.
This issue was resolved and addressed in GLSA 201301-01 at http://security.gentoo.org/glsa/glsa-201301-01.xml by GLSA coordinator Sean Amoss (ackle).