Release is set to around Wednesday 2005-03-23 1000PST. Brad should be around to push them in Portage. No complete details of what is fixed yet.
---------------------------------------------------------- Mozilla Foundation Security Advisory 2005-32 (CAN-2005-0401) Title: Drag and drop loading of privileged XUL Severity: Low Risk: Moderate Reporter: Michael Krax Fixed in: Firefox 1.0.2, Mozilla Suite 1.7.6 Description A malicious page that could lure a user into dragging something (such as a fake scrollbar) can bypass the restriction on opening privileged XUL. The startup scripts in the XUL will run with enhanced privilege, though the actions taken upon merely opening most XUL are benign. So far no way to run arbitrary code supplied by the attacker has been found, but this could be a stepping-stone to future attacks. Workaround: Disable Javascript. Upgrade to the fixed version. References http://mikx.de/firescrolling2/ https://bugzilla.mozilla.org/show_bug.cgi?id=285438 ---------------------------------------------------------- Mozilla Foundation Security Advisory 2005-30 (CAN-2005-0399) Title: GIF heap overflow parsing Netscape extension 2 Severity: Critical Risk: High Reporter: Mark Dowd (ISS X-Force) Fixed in: Firefox 1.0.2, Thunderbird 1.0.2, Mozilla Suite 1.7.6 Description An GIF processing error when parsing the obsolete Netscape extension 2 can lead to an exploitable heap overrun, allowing an attacker to run arbitrary code on the user's machine. Workaround: Turn off image display. Upgrade to the fixed version. References https://bugzilla.mozilla.org/show_bug.cgi?id=285595 ------------------------------------------------------------ Mozilla Foundation Security Advisory 2005-31 (CAN-2005-0402) Title: Arbitrary code execution from Firefox sidebar panel Severity: Critical Risk: Moderate Reporter: Kohei Yoshino Fixed in: Firefox 1.0.2 Description If a user bookmarked a malicious page as a Firefox sidebar panel that page could execute arbitrary programs by opening a privileged page and injecting javascript into it. Workaround: Do not add sidebar panels. Upgrade to fixed version References https://bugzilla.mozilla.org/show_bug.cgi?id=284627 -----------------------------------------------------------
It's out. Mozilla team, please bump !
*** Bug 86408 has been marked as a duplicate of this bug. ***
mozilla-firefox-1.0.2 is in arches, please test and mark stable if possible
Arches please test and mark stable: mozilla-firefox-1.0.2: alpha amd64 arm hppa ia64 ppc sparc mozilla-firefox-bin-1.0.2: amd64
mozilla-firefox-1.0.2 stable on amd64.
ppc stable
Stable on SPARC.
marked arm/hppa stable ... alpha/ia64 was already done
amd64: please mark mozilla-firefox-bin-1.0.2 stable
amd64 done
GLSA 200503-31