Summary: | www-client/mozilla-firefox[-bin]: <=1.5.0.3 Multiple vulnerabilities including remote code execution | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Raphael Marichez (Falco) (RETIRED) <falco> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | major | CC: | mozilla, suka, tcort |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
URL: | http://secunia.com/advisories/20376/ | ||
Whiteboard: | A2 [glsa] Falco | ||
Package list: | Runtime testing required: | --- |
Description
Raphael Marichez (Falco) (RETIRED)
2006-06-02 04:25:48 UTC
Moz team, please bump 1.5.0.4 ebuild please The 1.0 branch is probably vulnerable to certain of the issues, but this is not fixed yet regarding http://www.mozilla.org/projects/security/known-vulnerabilities.html adding http://www.mozilla.org/security/announce/2006/mfsa2006-39.html and http://www.mozilla.org/security/announce/2006/mfsa2006-41.html to what Secunia reports the whole list it then : MFSA 2006-43 Privilege escalation using addSelectionListener MFSA 2006-42 Web site XSS using BOM on UTF-8 pages MFSA 2006-41 File stealing by changing input type (variant) MFSA 2006-39 "View Image" local resource linking (Windows) MFSA 2006-38 Buffer overflow in crypto.signText() MFSA 2006-37 Remote compromise via content-defined setter on object prototypes MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2 MFSA 2006-35 Privilege escalation through XUL persist MFSA 2006-34 XSS viewing javascript: frames or images from context menu MFSA 2006-33 HTTP response smuggling MFSA 2006-32 Fixes for crashes with potential memory corruption MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey) sorry for the spam. I shoud stop bugzie or take some rest According to the advisory all versions are affected. No bugfix for 1.0.8, yet and despite the announcement, I still get "access denied" when I try to look at the relevant upstream bugs. *** Bug 135282 has been marked as a duplicate of this bug. *** (In reply to comment #5) > According to the advisory all versions are affected. No bugfix for 1.0.8, yet > and despite the announcement, I still get "access denied" when I try to look at > the relevant upstream bugs. > There won't be any more updates to the 1.0.x-series (and the mozilla-suite), this was publicly announced a few weeks ago: http://developer.mozilla.org/devnews/index.php/2006/04/12/sunset-announcement-for-fxtb-10x-and-mozilla-suite-17x/ 1.5.0.4 is in the tree feel free to add all archs and have them mark stable. Do not forget to have amd64 and x86 mark -bin stable. Well time is here it is 1.5.0.4 for all or nothing. There are gonna be no more revisions for the 1.0.x branch!! If for some reason your arch will not work with 1.5.x we will have to mask firefox on that arch until problem is resolved, patches can be backported but that will be left up to the archs to handle that can not deal with 1.5.x series of firefox. I will handle amd64 source and binary package x86 team do not forget -bin as well please. amd64 and ppc already done sorry forgot to add you last go around amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be unmaintained by upstream now. arches, don't forget -bin :) (In reply to comment #11) > amd64 and ppc will have to stabilize 1.5.0.4 since 1.0.x seems to be > unmaintained by upstream now. > I would suggest ya read the entire bug before adding archs that are already done. Stable on hppa. x86 done firefox is still broken on alpha, see bug #128777. I've masked 'www-client/mozilla-firefox' in profiles/default-linux/alpha/package.mask until it is fixed. I also masked the 'firefox' USE flag in profiles/default-linux/alpha/use.mask. sparc stable. Ready for GLSA. GLSA 200606-12 |