10:33 a.m.
Matthew Miller wrote:
On Sat, Jun 03, 2006 at 02:36:13PM -0500, David Eisenstein wrote:
>It mentions a bunch of vulnerabilities (all of which seem to affect
>Seamonkey, Thunderbird, and Firefox). After looking at each VU#, it appears
>that none of the announcements mention the Mozilla suite. Also, at least as
>of last night, none of them mention any CVE #'s.
No updates for Firefox for Fedora Core yet, either....
<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
I heard a rumor the other day that Red Hat Enterprise Linux may be planning
to replace Mozilla with Seamonkey in their currently-maintained distros. Am
wondering if there is any truth to this rumor? Also wondering if there is
anything we in Fedora Legacy can do to help in this process of dealing with
these critical Mozilla/Firefox/Seamonkey bugs?
Fedora Legacy bug for these issues:
<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194440>
Congrats to Fedora Extras for getting Seamonkey packages out already! :)
Regards,
David
12:08 p.m.
Matthew Miller wrote:
> On Sat, Jun 03, 2006 at 02:36:13PM -0500, David Eisenstein wrote:
>
>>It mentions a bunch of vulnerabilities (all of which seem to affect
>>Seamonkey, Thunderbird, and Firefox). After looking at each VU#, it appears
>>that none of the announcements mention the Mozilla suite. Also, at least as
>>of last night, none of them mention any CVE #'s.
>
>
> No updates for Firefox for Fedora Core yet, either....
>
> <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
>
I heard a rumor the other day that Red Hat Enterprise Linux may be planning
to replace Mozilla with Seamonkey in their currently-maintained distros. Am
wondering if there is any truth to this rumor? Also wondering if there is
anything we in Fedora Legacy can do to help in this process of dealing with
these critical Mozilla/Firefox/Seamonkey bugs?
This is true. We're going with seamonkey in RHEL. I think this current
round of issues is proof as to why this has to happen. Backporting to the
firefox 1.0 branch is nearly impossible given the drastic changes between
versions.
Right now we're furiously working on backporting patches for the most
critical issues. If you want to help mail Chris Aillon (caillon@redhat)
with your request. He's currently heading up a small group of various
distributors trying to get all this work done.
--
JB
12:38 p.m.
On Fri, Jun 09, 2006 at 01:08:30PM -0400, Josh Bressers wrote:
Right now we're furiously working on backporting patches for the
most
critical issues. If you want to help mail Chris Aillon (caillon@redhat)
with your request. He's currently heading up a small group of various
distributors trying to get all this work done.
In the meantime, can someone take care of the simpler case of updating FC5
from 1.5.0.3 to 1.5.0.4?
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
12:44 p.m.
On 6/9/06, Josh Bressers <bressers(a)redhat.com> wrote:
>
> Matthew Miller wrote:
> > On Sat, Jun 03, 2006 at 02:36:13PM -0500, David Eisenstein wrote:
> >
> >>It mentions a bunch of vulnerabilities (all of which seem to affect
> >>Seamonkey, Thunderbird, and Firefox). After looking at each VU#, it
appears
> >>that none of the announcements mention the Mozilla suite. Also, at least
as
> >>of last night, none of them mention any CVE #'s.
> >
> >
> > No updates for Firefox for Fedora Core yet, either....
> >
> > <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
> >
>
> I heard a rumor the other day that Red Hat Enterprise Linux may be planning
> to replace Mozilla with Seamonkey in their currently-maintained distros. Am
> wondering if there is any truth to this rumor? Also wondering if there is
> anything we in Fedora Legacy can do to help in this process of dealing with
> these critical Mozilla/Firefox/Seamonkey bugs?
This is true. We're going with seamonkey in RHEL. I think this current
round of issues is proof as to why this has to happen. Backporting to the
firefox 1.0 branch is nearly impossible given the drastic changes between
versions.
Right now we're furiously working on backporting patches for the most
critical issues. If you want to help mail Chris Aillon (caillon@redhat)
with your request. He's currently heading up a small group of various
distributors trying to get all this work done.
I would say that it is not worth the effort to do that much
backporting. I am having to deal with sites that just want to block
old Firefox browser strings anyway at their firewalls. So my day job
is basically going to be get 1.5.0.4{5,6,7} onto RHL-7.3 -> RHEL-4
anyway.
My {I am not much of a coder, but have to deal with the mess left over
by them} possition would be that getting a modularized javascript
interpreter written, debugged, security minded than trying to back-fix
things might be a better idea.
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
6:28 p.m.
Josh Bressers wrote:
>Matthew Miller wrote:
>
>>On Sat, Jun 03, 2006 at 02:36:13PM -0500, David Eisenstein wrote:
>>
>>
>>>It mentions a bunch of vulnerabilities (all of which seem to affect
>>>Seamonkey, Thunderbird, and Firefox). After looking at each VU#, it appears
>>>that none of the announcements mention the Mozilla suite. Also, at least as
>>>of last night, none of them mention any CVE #'s.
>>
>>
>>No updates for Firefox for Fedora Core yet, either....
>>
>><https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
>>
>I heard a rumor the other day that Red Hat Enterprise Linux may be planning
>to replace Mozilla with Seamonkey in their currently-maintained distros. Am
>wondering if there is any truth to this rumor? Also wondering if there is
>anything we in Fedora Legacy can do to help in this process of dealing with
>these critical Mozilla/Firefox/Seamonkey bugs?
This is true. We're going with seamonkey in RHEL. I think this current
round of issues is proof as to why this has to happen. Backporting to the
firefox 1.0 branch is nearly impossible given the drastic changes between
versions.
Right now we're furiously working on backporting patches for the most
critical issues. If you want to help mail Chris Aillon (caillon@redhat)
with your request. He's currently heading up a small group of various
distributors trying to get all this work done.
You are backporting patches then for the most critical issues for Mozilla
suite 1.7.13 only, Josh? Or also for Firefox-1.0.8?
Regards,
David
11:25 p.m.
>
>
> This is true. We're going with seamonkey in RHEL. I think this current
> round of issues is proof as to why this has to happen. Backporting to the
> firefox 1.0 branch is nearly impossible given the drastic changes between
> versions.
>
> Right now we're furiously working on backporting patches for the most
> critical issues. If you want to help mail Chris Aillon (caillon@redhat)
> with your request. He's currently heading up a small group of various
> distributors trying to get all this work done.
>
You are backporting patches then for the most critical issues for Mozilla
suite 1.7.13 only, Josh? Or also for Firefox-1.0.8?
We're working on just the critical issues. The codebase for suite 1.7.13
and Firefox 1.0.8 are nearly the same. Patches for one should apply to the
other.
--
JB
9:44 p.m.
On 6/9/06, Josh Bressers <bressers(a)redhat.com> wrote:
> >
> >
> > This is true. We're going with seamonkey in RHEL. I think this current
> > round of issues is proof as to why this has to happen. Backporting to the
> > firefox 1.0 branch is nearly impossible given the drastic changes between
> > versions.
> >
> > Right now we're furiously working on backporting patches for the most
> > critical issues. If you want to help mail Chris Aillon (caillon@redhat)
> > with your request. He's currently heading up a small group of various
> > distributors trying to get all this work done.
> >
>
> You are backporting patches then for the most critical issues for Mozilla
> suite 1.7.13 only, Josh? Or also for Firefox-1.0.8?
We're working on just the critical issues. The codebase for suite 1.7.13
and Firefox 1.0.8 are nearly the same. Patches for one should apply to the
other.
Ok this seems more confusing. The RHEL-3 U8 beta is supposed to move
to seamonkey which is 1.8.x based. It would seem that if were the
case.. it would be better to move everyone to the 1.8.x base
(RHEL-4/FC-x).. or maybe I am just not understanding everything that
is happening.
--
Stephen J Smoogen.
CSIRT/Linux System Administrator
5:43 a.m.
On 6/9/06, Josh Bressers <bressers(a)redhat.com> wrote:
> > >
> > >
> > > This is true. We're going with seamonkey in RHEL. I think this
current
> > > round of issues is proof as to why this has to happen. Backporting to
the
> > > firefox 1.0 branch is nearly impossible given the drastic changes between
> > > versions.
> > >
> > > Right now we're furiously working on backporting patches for the most
> > > critical issues. If you want to help mail Chris Aillon (caillon@redhat)
> > > with your request. He's currently heading up a small group of
various
> > > distributors trying to get all this work done.
> > >
> >
> > You are backporting patches then for the most critical issues for Mozilla
> > suite 1.7.13 only, Josh? Or also for Firefox-1.0.8?
>
> We're working on just the critical issues. The codebase for suite 1.7.13
> and Firefox 1.0.8 are nearly the same. Patches for one should apply to the
> other.
>
Ok this seems more confusing. The RHEL-3 U8 beta is supposed to move
to seamonkey which is 1.8.x based. It would seem that if were the
case.. it would be better to move everyone to the 1.8.x base
(RHEL-4/FC-x).. or maybe I am just not understanding everything that
is happening.
The plan is to move everything to seamonkey, but there is much testing that
needs to be done. We're not ready yet, which is why we are backporting the
critical patches first.
--
JB
9:57 a.m.
On Mon, Jun 12, 2006 at 06:43:22AM -0400, Josh Bressers wrote:
The plan is to move everything to seamonkey, but there is much
testing that
needs to be done. We're not ready yet, which is why we are backporting the
critical patches first.
But in the meantime, what about firefox in FC5, which is already 1.5.0.x?
Does the (presumably) easier fix for the current release have to wait on the
harder work for the older releases? As far as I can tell, there wasn't even
a bug entry for this, and I had to file it myself. (And it's gotten no
response at all.)
<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
C'mon, it may not be a remote root compromise, but it is highly visible and
_could_ allow remote code execution. Fedora can do better than this!
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
12:07 p.m.
Matthew Miller wrote:
On Mon, Jun 12, 2006 at 06:43:22AM -0400, Josh Bressers wrote:
> The plan is to move everything to seamonkey, but there is much testing that
> needs to be done. We're not ready yet, which is why we are backporting the
> critical patches first.
>
But in the meantime, what about firefox in FC5, which is already 1.5.0.x?
Does the (presumably) easier fix for the current release have to wait on the
harder work for the older releases? As far as I can tell, there wasn't even
a bug entry for this, and I had to file it myself. (And it's gotten no
response at all.)
<https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
C'mon, it may not be a remote root compromise, but it is highly visible and
_could_ allow remote code execution. Fedora can do better than this!
If someone wants to simply rev the spec, commit, and build, that's fine
(and very welcome) as long as the Release is set to 2 for rawhide, and
1.1.fc5 for fc5 (to keep up with my numbering scheme). I find its best
to not jump out of doing something you'd rather not jump back into,
which is why I'm focusing on the backport.
12:10 p.m.
Matthew Miller wrote:
> On Mon, Jun 12, 2006 at 06:43:22AM -0400, Josh Bressers wrote:
>
>
If someone wants to simply rev the spec, commit, and build, that's fine
(and very welcome) as long as the Release is set to 2 for rawhide, and
1.1.fc5 for fc5 (to keep up with my numbering scheme). I find its best
to not jump out of doing something you'd rather not jump back into,
which is why I'm focusing on the backport.
Can someone outside of redhat do that?
Dennis
12:11 p.m.
On Mon, Jun 12, 2006 at 01:07:43PM -0400, Christopher Aillon wrote:
If someone wants to simply rev the spec, commit, and build,
that's fine
(and very welcome) as long as the Release is set to 2 for rawhide, and
1.1.fc5 for fc5 (to keep up with my numbering scheme). I find its best
to not jump out of doing something you'd rather not jump back into,
which is why I'm focusing on the backport.
Yeah, I certainly don't blame you -- clearly you've got a lot going on. But
for a package as important as this one, someone should get you some help. :)
--
Matthew Miller mattdm(a)mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
12:21 p.m.
Stephen John Smoogen wrote:
On 6/9/06, Josh Bressers <bressers(a)redhat.com> wrote:
> >
> > Matthew Miller wrote:
> > > On Sat, Jun 03, 2006 at 02:36:13PM -0500, David Eisenstein wrote:
> > >
> > >>It mentions a bunch of vulnerabilities (all of which seem to affect
> > >>Seamonkey, Thunderbird, and Firefox). After looking at each VU#,
> it appears
> > >>that none of the announcements mention the Mozilla suite. Also,
> at least as
> > >>of last night, none of them mention any CVE #'s.
> > >
> > >
> > > No updates for Firefox for Fedora Core yet, either....
> > >
> > > <https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=194617>
> > >
> >
> > I heard a rumor the other day that Red Hat Enterprise Linux may be
> planning
> > to replace Mozilla with Seamonkey in their currently-maintained
> distros. Am
> > wondering if there is any truth to this rumor? Also wondering if
> there is
> > anything we in Fedora Legacy can do to help in this process of
> dealing with
> > these critical Mozilla/Firefox/Seamonkey bugs?
>
> This is true. We're going with seamonkey in RHEL. I think this current
> round of issues is proof as to why this has to happen. Backporting
> to the
> firefox 1.0 branch is nearly impossible given the drastic changes
> between
> versions.
>
> Right now we're furiously working on backporting patches for the most
> critical issues. If you want to help mail Chris Aillon (caillon@redhat)
> with your request. He's currently heading up a small group of various
> distributors trying to get all this work done.
>
I would say that it is not worth the effort to do that much
backporting. I am having to deal with sites that just want to block
old Firefox browser strings anyway at their firewalls. So my day job
is basically going to be get 1.5.0.4{5,6,7} onto RHL-7.3 -> RHEL-4
anyway.
My {I am not much of a coder, but have to deal with the mess left over
by them} possition would be that getting a modularized javascript
interpreter written, debugged, security minded than trying to back-fix
things might be a better idea.
That would take years of effort to duplicate
something that already
exists. SpiderMonkey (the mozilla.org JavaScript engine) is very
security minded, and very modularized. Download it from mozilla.org/js
but not that while there are occasional issues in it, there aren't very
many. You are confusing JavaScript (the language) with DOM (an object
model), which is where all the security holes are because it is designed
to be a security hole if you think about it. The point of the DOM is to
give web sites access to things that HTML doesn't give them, and lets
them control the browser in certain ways. Just like you don't claim
that C is insecure when there's a kernel vulnerability, you should be
careful with claiming JavaScript is insecure when there is a DOM
vulnerability. JavaScript bindings are simply more readily available to
websites than the native bindings, but those are also vulnerable if you
ever install extensions which make use of them (such as enigmail).
6525
days inactive
6528
days old
security@lists.fedoraproject.org
12 comments
6 participants
participants (6)
-
Christopher Aillon -
David Eisenstein -
Dennis Gilmore -
Josh Bressers -
Matthew Miller -
Stephen John Smoogen