Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 231975 - www-client/mozilla-firefox(-bin) < 3.0.1, < 2.0.0.16: two vulnerabilities (CVE-2008-{2933,2785,3198})
Summary: www-client/mozilla-firefox(-bin) < 3.0.1, < 2.0.0.16: two vulnerabilities (CV...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A2 [glsa]
Keywords:
: 228495 (view as bug list)
Depends on:
Blocks:
 
Reported: 2008-07-16 15:31 UTC by Hanno Böck
Modified: 2020-04-09 19:03 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 1 Robert Buchholz (RETIRED) gentoo-dev 2008-07-16 18:57:35 UTC 
*** Bug 228495 has been marked as a duplicate of this bug. ***
Comment 2 Raúl Porcel (RETIRED) gentoo-dev 2008-07-17 10:26:18 UTC 
To stabilize:
=www-client/mozilla-firefox-2.0.0.16
Arches: "alpha amd64 arm hppa ia64 mips ppc ppc64 sparc x86"
=www-client/mozilla-firefox-bin-2.0.0.16
ches: "amd64 x86"
=www-client/seamonkey-1.1.11
Arches: "alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"
=www-client/seamonkey-bin-1.1.11
ches: "amd64 x86"
=net-libs/xulrunner-1.8.1.16
Arches: "alpha amd64 arm hppa ia64 ppc ppc64 sparc x86"
=net-libs/xulrunner-bin-1.8.1.16
Arches: "amd64 x86"

3.0.1 will be in the tree as well, but is not stable
Comment 3 Raúl Porcel (RETIRED) gentoo-dev 2008-07-17 18:16:47 UTC 
alpha/ia64/sparc stable
Comment 4 Markus Rothe (RETIRED) gentoo-dev 2008-07-17 19:31:45 UTC 
ppc64 stable
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2008-07-18 03:30:59 UTC 
(In reply to comment #2)
> =www-client/mozilla-firefox-2.0.0.16

Stable for HPPA.

> =www-client/seamonkey-1.1.11

Stable for HPPA.

> ches: "amd64 x86"

A slight error in the script? :)

> =net-libs/xulrunner-1.8.1.16

Stable for HPPA.

> 3.0.1 will be in the tree as well, but is not stable

What about xulrunner-1.9?
Comment 6 Christian Faulhammer (RETIRED) gentoo-dev 2008-07-18 09:22:42 UTC 
x86 stable
Comment 7 Tobias Scherbaum (RETIRED) gentoo-dev 2008-07-19 10:05:46 UTC 
ppc stable
Comment 8 Víctor Enríquez 2008-07-21 16:37:12 UTC 
====AMD64 AT REPORT====

I tested bin version on amd64, seems to work ok, I will test non bin version this night. 

*Installation[OK]
*No Test
*Functionality[OK]

emerge --info:

Portage 2.1.4.4 (default/linux/amd64/2008.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.25-gentoo-r6 x86_64)
=================================================================
System uname: 2.6.25-gentoo-r6 x86_64 AMD Athlon(tm) 64 Processor 3200+
Timestamp of tree: Sun, 20 Jul 2008 18:30:03 +0000
app-shells/bash:     3.2_p33
dev-lang/python:     2.5.2-r5
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.61-r2
sys-devel/automake:  1.7.9-r1, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-march=k8 -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="distlocks metadata-transfer parallel-fetch sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS=" ftp://ftp.free.fr/mirrors/ftp.gentoo.org/  ftp://ftp.tu-clausthal.de/pub/linux/gentoo/  ftp://sunsite.informatik.rwth-aachen.de/pub/Linux/gentoo "
LDFLAGS="-Wl,-O1"
LINGUAS="en"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/portage/local/layman/sunrise /usr/portage/local/layman/desktop-effects /usr/local/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow 3dnowext X a52 aac acl acpi alsa amd64 bzip2 cairo cli consolekit crypt dbus dga dri dv dvb exif ffmpeg flac glitz gmp gpm gstreamer gtk hal hddtemp iconv ieee1394 ipv6 isdnlog ithreads joystick jpeg lcms libnotify lm_sensors mad midi mmx mmxext mng mp3 mpeg mudflap multilib ncurses network nls nptl nptlonly ogg opengl openmp pam pcre perl png pppd python readline reflection sdl session spell spl sse sse2 ssl startup-notification svg tcpd theora threads tiff unicode vorbis wifi x264 xcomposite xorg xscreensaver xv xvid xvmc zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en" USERLAND="GNU" VIDEO_CARDS="nvidia"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS
Comment 9 Víctor Enríquez 2008-07-23 20:49:39 UTC 
====AMD64 AT REPORT====

=net-libs/xulrunner-1.8.1.16 USE="gnome ipv6 java xinerama xprint -debug"

*Installation[OK]
*No Test
*Functionality[OK]: 


The following rdeps compile and seems to work ok with =net-libs/xulrunner-1.8.1.16:

gnome-extra/yelp-2.20.0 
media-video/totem-2.20.3
www-client/epiphany-2.20.3
dev-python/gnome-python-extras-2.19.1-r1
net-news/liferea-1.4.15
dev-java/swt-3.3.1.1

The following rdeps fails compilation:
-app-text/gnomesword-2.1.7: 
checking for GTKHTML... checking for GTKHTML... make: *** No targets specified and no makefile found.  Stop.


emerge --info:

Portage 2.1.4.4 (default/linux/amd64/2008.0, gcc-4.1.2, glibc-2.6.1-r0, 2.6.25-gentoo-r6 x86_64)
=================================================================
System uname: 2.6.25-gentoo-r6 x86_64 AMD Athlon(tm) 64 Processor 3200+
Timestamp of tree: Sun, 20 Jul 2008 18:30:03 +0000
app-shells/bash:     3.2_p33
dev-java/java-config: 1.3.7, 2.1.6
dev-lang/python:     2.5.2-r5
dev-python/pycrypto: 2.0.1-r6
sys-apps/baselayout: 1.12.11.1
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r2
sys-devel/automake:  1.5, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10.1
sys-devel/binutils:  2.18-r3
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.26
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="amd64"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=k8 -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/splash /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-march=k8 -O2 -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="collision-protect distlocks metadata-transfer multilib-strict parallel-fetch sandbox sfperms strict test unmerge-orphans userfetch"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo"
LDFLAGS="-Wl,-O1"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="3dnow X a52 aac acl acpi alsa amd64 berkdb bzip2 cairo cdr cli cracklib crypt dbus dga dri dvd dvdr ffmpeg flac fortran gdbm glitz gmp gnome gpm gstreamer gtk hal iconv ipv6 isdnlog ithreads java jpeg lcms libnotify mad midi mmx mono mp3 mpeg mudflap multilib ncurses network nls nptl nptlonly nsplugin ogg opengl openmp pam pcre perl png pppd python readline reflection sdl session spell spl sse sse2 ssl startup-notification svg tcpd theora threads truetype unicode v4l vorbis x264 xcomposite xinerama xorg xprint xscreensaver xulrunner xv xvid zlib" ALSA_CARDS="emu10k1" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="evdev keyboard mouse joystick" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="nvidia none"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY
Comment 10 Raúl Porcel (RETIRED) gentoo-dev 2008-07-24 14:14:25 UTC 
Please stabilize =mail-client/mozilla-thunderbird[-bin]-2.0.0.16 and its deps, thanks.
Comment 11 Markus Rothe (RETIRED) gentoo-dev 2008-07-26 07:26:20 UTC 
ppc64 stable

sorry for the delay...
Comment 12 Tobias Scherbaum (RETIRED) gentoo-dev 2008-08-03 17:58:22 UTC 
ppc stable
Comment 13 Tobias Heinlein (RETIRED) gentoo-dev 2008-08-04 15:16:50 UTC 
amd64 stable
Comment 14 Robert Buchholz (RETIRED) gentoo-dev 2008-08-06 00:44:11 UTC 
GLSA 200808-03