New Release 1.5.0.4 with multiple security fixes

[John Eikenberry]

http://www.mozilla.com/firefox/releases/1.5.0.4.html

Important security issues fixed with this release.

MFSA 2006-43 Privilege escalation using addSelectionListener
MFSA 2006-42 Web site XSS using BOM on UTF-8 pages
MFSA 2006-41 File stealing by changing input type (variant)
MFSA 2006-39 "View Image" local resource linking (Windows)
MFSA 2006-38 Buffer overflow in crypto.signText()
MFSA 2006-37 Remote compromise via content-defined setter on object prototypes
MFSA 2006-36 PLUGINSPAGE privileged JavaScript execution 2
MFSA 2006-35 Privilege escalation through XUL persist
MFSA 2006-34 XSS viewing javascript: frames or images from context menu
MFSA 2006-33 HTTP response smuggling
MFSA 2006-32 Fixes for crashes with potential memory corruption
MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey)

[John Dong (jdong)]

This is a security issue. Is there any plan to include this in dapper-security yet?

[Martin Pitt (pitti)]

Hi,

John Dong [2006-06-04 20:30 -0000]:
> This is a security issue. Is there any plan to include this in dapper-
> security yet?

Yes, very soon (next week).

Martin

--
Martin Pitt http://www.piware.de
Ubuntu Developer http://www.ubuntulinux.org
Debian Developer http://www.debian.org

[John Dong (jdong)]

Alright, glad to hear that. Thanks for keeping us updated on that :)

On 6/4/06, Martin Pitt <email address hidden> wrote:
>
> Hi,
>
> John Dong [2006-06-04 20:30 -0000]:
> > This is a security issue. Is there any plan to include this in dapper-
> > security yet?
>
> Yes, very soon (next week).
>
> Martin
>
> --
> Martin Pitt http://www.piware.de
> Ubuntu Developer http://www.ubuntulinux.org
> Debian Developer http://www.debian.org
>
> --
> New Release 1.5.0.4 with multiple security fixes
> https://launchpad.net/bugs/48043
>

[Martin Pitt (pitti)]

Ian prepared a package, will be uploaded soon.

[Martin Pitt (pitti)]

Just for the records, 1.5.0.4 is in dapper since last week. Keeping this bug open until hoary and breezy are fixed.

[Bruce Cowan (bruce89-deactivatedaccount)]

Added specific release details, probably not a good idea.

[Martin Pitt (pitti)]

USN-296-2