Bug 200909 – www-client/seamonkey (bin) < 1.1.7 Multiple vulnerabilities (CVE-2007-{5947,5959,5960})

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Arttu Valo 2007-12-01 11:00:34 UTC]

Mozilla Seamonkey 1.1.7 has been released with fixes to security vulnerabilities, apparently the same ones for which Firefox just got its 2.0.0.10 update, too.

Reproducible: Always

[Comment 1 Robert Buchholz (RETIRED) 2007-12-01 23:41:38 UTC]

See bug 198965 for vulnerability details.

[Comment 2 Lars Wendler (Polynomial-C) (RETIRED) 2007-12-02 14:37:41 UTC]

Created attachment 137542 [details]
030_pango-cairo-1.patch.diff

There are two changes necessary to get the seamonkey-1.1.6-patches-0.1.tar.bz2 applied:

009_firefox-gdkpango.patch can be dropped, this was finally included into 1.1.7 release.
030_pango-cairo-1.patch needs a small tweak (see attachment).

[Comment 3 Raúl Porcel (RETIRED) 2007-12-03 21:45:31 UTC]

In CVS, thanks Lars for the fix :)

[Comment 4 Robert Buchholz (RETIRED) 2007-12-04 00:54:06 UTC]

Arches, please test and mark stable www-client/seamonkey-1.1.7.
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 x86"

[Comment 5 Christian Faulhammer (RETIRED) 2007-12-04 12:39:01 UTC]

x86 stable

[Comment 6 Raúl Porcel (RETIRED) 2007-12-04 15:22:06 UTC]

alpha/ia64/sparc stable

[Comment 7 Markus Rothe (RETIRED) 2007-12-04 18:00:03 UTC]

ppc64 stable

[Comment 8 Tobias Scherbaum (RETIRED) 2007-12-04 21:11:16 UTC]

ppc stable

[Comment 9 Thomas Tuttle 2007-12-05 00:08:02 UTC]

Compiles, merges, and works on amd64.

emerge --info:

Portage 2.1.3.19 (default-linux/amd64/2007.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.22-gentoo-r9 x86_64)
=================================================================
System uname: 2.6.22-gentoo-r9 x86_64 Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz
Timestamp of tree: Tue, 04 Dec 2007 23:30:01 +0000
app-shells/bash:     3.2_p17
dev-java/java-config: 1.3.7, 2.0.33-r1
dev-lang/python:     2.4.4-r6, 2.5.1-r4
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.9-r2
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.3.16
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.22-r2
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -fomit-frame-pointer -march=nocona"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/texmf/web2c /etc/udev/rules.d"
CXXFLAGS="-O2 -pipe -fomit-frame-pointer -march=nocona"
DISTDIR="/usr/portage/distfiles"
FEATURES="collision-protect distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict test unmerge-orphans userfetch"
GENTOO_MIRRORS="http://gentoo.cites.uiuc.edu/pub/gentoo/"
LINGUAS="en"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X a52 aac acl acpi alsa amd64 berkdb bitmap-fonts cli cracklib crypt cups dri flac fortran gdbm gif gpm iconv ipv6 isdnlog jpeg midi mmx mp3 mudflap ncurses nls nptl nptlonly ogg opengl openmp pam pcre perl png pppd python readline reflection session spl sse sse2 ssl tcpd test truetype-fonts type1-fonts unicode vorbis xorg xv zlib" ALSA_CARDS="hda-intel" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en" USERLAND="GNU" VIDEO_CARDS="i810 vesa vga"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 10 Jeroen Roovers (RETIRED) 2007-12-05 03:17:01 UTC]

The HPPA patch from bug #180870 seems not to have been applied to seamonkey (compare [1] and [2]).


[1] http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/mozilla-firefox/2.0.0.10/004_mozilla-hppa.patch?rev=1.2&view=markup
[2] http://sources.gentoo.org/viewcvs.py/gentoo/src/patchsets/seamonkey/1.1.7/004_mozilla-hppa.patch?rev=1.1&view=markup

[Comment 11 Raúl Porcel (RETIRED) 2007-12-05 10:55:03 UTC]

(In reply to comment #10)

shrug, fixed in patchset 0.2 :) Sorry

[Comment 12 Peter Weller (RETIRED) 2007-12-06 21:49:54 UTC]

beandog did amd64...

[Comment 13 Jeroen Roovers (RETIRED) 2007-12-07 16:12:50 UTC]

Stable for HPPA.

[Comment 14 Pierre-Yves Rofes (RETIRED) 2007-12-08 23:33:05 UTC]

glsarequestfiled

[Comment 15 Robert Buchholz (RETIRED) 2007-12-29 16:13:34 UTC]

GLSA 200712-20, thanks everyone.

[Comment 16 Peter Volkov (RETIRED) 2008-03-06 09:55:01 UTC]

Does not affect current (2008.0) release. Removing release.