~ubuntu-branches/ubuntu/intrepid/xulrunner/intrepid-security : changes

~ubuntu-branches/ubuntu/intrepid/xulrunner/intrepid-security » Changes from revision 27

From Revision 27 to 8

Rev	Summary	Authors	Tags	Date
27	* New security upstream release - backports for ffox 3.0.8 * New security upstream release - backports for ffox 3.0.8 + Fixed on Firefox EOL branch - MFSA 2009-13 Arbitrary code execution through XUL <tree> element - MFSA 2009-12 XSL Transformation vulnerability - MFSA 2009-10 Upgrade PNG library to fix memory safety hazards - MFSA 2009-09 XML data theft via RDFXMLDataSource and cross-domain redirect - MFSA 2009-07 Crashes with evidence of memory corruption (rv:1.9.0.7) - MFSA 2009-05 XMLHttpRequest allows reading HTTPOnly cookies - MFSA 2009-03 Local file stealing with SessionStore - MFSA 2009-01 Crashes with evidence of memory corruption (rv:1.9.0.6) + Fixed in Firefox 2.0.0.20 - MFSA 2008-65 Cross-domain data theft via script redirect error message (Windows) + Fixed in Firefox 2.0.0.19 - MFSA 2008-69 XSS vulnerabilities in SessionStore - MFSA 2008-68 XSS and JavaScript privilege escalation - MFSA 2008-67 Escaped null characters ignored by CSS parser - MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters - MFSA 2008-65 Cross-domain data theft via script redirect error message - MFSA 2008-64 XMLHttpRequest 302 response disclosure - MFSA 2008-62 Additional XSS attack vectors in feed preview - MFSA 2008-61 Information stealing via loadBindingDocument - MFSA 2008-60 Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19) + Fixed in Firefox 2.0.0.18 - MFSA 2008-58 Parsing error in E4X default namespace - MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals - MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation - MFSA 2008-55 Crash and remote code execution in nsFrameManager - MFSA 2008-54 Buffer overflow in http-index-format parser - MFSA 2008-53 XSS and JavaScript privilege escalation via session restore - MFSA 2008-52 Crashes with evidence of memory corruption (rv:1.9.0.4/1.8.1.18) - MFSA 2008-50 Crash and remote code execution via __proto__ tampering - MFSA 2008-49 Arbitrary code execution via Flash Player dynamic module unloading - MFSA 2008-48 Image stealing via canvas and HTTP redirect - MFSA 2008-47 Information stealing via local shortcut files + Fixed in Firefox 2.0.0.17 - MFSA 2008-45 XBM image uninitialized memory reading - MFSA 2008-44 resource: traversal vulnerabilities - MFSA 2008-43 BOM characters stripped from JavaScript before execution - MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17) - MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution - MFSA 2008-40 Forced mouse drag - MFSA 2008-39 Privilege escalation using feed preview page and XSS flaw - MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation - MFSA 2008-37 UTF-8 URL stack buffer overflow	Alexander Sack	1.8.1.18+nobinonly.b308.cvs20090331t155113-0ubuntu0.8.10.1	15 years ago
26	* New upstream release (taken from upstream CVS), LP: #25461... * New upstream release (taken from upstream CVS), LP: #254618. * Fix MFSA 2008-35, MFSA 2008-34, MFSA 2008-33, MFSA 2008-32, MFSA 2008-31, MFSA 2008-30, MFSA 2008-29, MFSA 2008-28, MFSA 2008-27, MFSA 2008-25, MFSA 2008-24, MFSA 2008-23, MFSA 2008-22, MFSA 2008-21, MFSA 2008-26 also known as CVE-2008-2933, CVE-2008-2785, CVE-2008-2811, CVE-2008-2810, CVE-2008-2809, CVE-2008-2808, CVE-2008-2807, CVE-2008-2806, CVE-2008-2805, CVE-2008-2803, CVE-2008-2802, CVE-2008-2801, CVE-2008-2800, CVE-2008-2798. * Drop 89_bz419350_attachment_306066 patch, merged upstream. * Bump Standards-Version to 3.8.0.	Devid Antonio Filoni	1.8.1.16+nobinonly-0ubuntu1	15 years ago
25	No-change upload to build against current libhunspell. No-change upload to build against current libhunspell.	Martin Pitt	1.8.1.14+nobinonly-1ubuntu4	15 years ago
24	* prepatch fix for FTBFS due to #include of not-existing * prepatch fix for FTBFS due to #include of not-existing iostream.h in ia64 code. - add debian/patches/bz419350_attachment_306066.dpatch - update debian/patches/00list	Alexander Sack	1.8.1.14+nobinonly-1ubuntu3	16 years ago
23	* fix FTBFS due to diverged configure patch * fix FTBFS due to diverged configure patch - update debian/patches/99_configure.dpatch	Alexander Sack	1.8.1.14+nobinonly-1ubuntu2	16 years ago
22	* New security upstream release: 1.8.1.14 (LP: #218534) * New security upstream release: 1.8.1.14 (LP: #218534) Fixes USN-602-1 / mfsa-2008-20 / CVE-2008-1380 * Merge from debian unstable (1.8.1.14-1). Remaining ubuntu changes: - debian/patches/88_force-no-pragma-visibility-for-gcc-4.2_4.3.dpatch - xulrunner alternative in /usr/bin * Update configure for the visibility patch: - update debian/patches/99_configure.dpatch	Fabien Tassin	1.8.1.14+nobinonly-1ubuntu1	16 years ago
21	* New security upstream release: 1.8.1.13 (LP: #207171) * New security upstream release: 1.8.1.13 (LP: #207171) * Security fixes: - MFSA 2008-19 XUL popup spoofing variant (cross-tab popups) - MFSA 2008-18 Java socket connection to any local port via LiveConnect - MFSA 2008-17 Privacy issue with SSL Client Authentication - MFSA 2008-16 HTTP Referrer spoofing with malformed URLs - MFSA 2008-15 Crashes with evidence of memory corruption - MFSA 2008-14 JavaScript privilege escalation and arbitrary code execution * Merge from debian unstable (1.8.1.12-5). Remaining ubuntu changes: - debian/patches/88_force-no-pragma-visibility-for-gcc-4.2_4.3.dpatch - xulrunner alternative in /usr/bin * Drop patches applied upstream: - drop debian/patches/10_SECAlgorithmIDTemplate.dpatch - update debian/patches/00list * Update diverged patches: - update debian/patches/99_configure.dpatch	Fabien Tassin	1.8.1.13+nobinonly-0ubuntu1	16 years ago
20	* Merge from debian unstable (LP: #174219), remaining change... * Merge from debian unstable (LP: #174219), remaining changes: - 88_bz384304_lp117575_linkrecursion_fix_in_startscript.dpatch - 88_bz399589_fix_missing_symbol_with_new_nss.dpatch - 88_force-no-pragma-visibility-for-gcc-4.2_4.3.dpatch - xulrunner alternative in /usr/bin - debian/xulrunner.install - debian/xulrunner.{postinst,prerm} * Update debian/patches/99_configure.dpatch	Fabien Tassin	1.8.1.11-1ubuntu1	16 years ago
19	* Merge from debian unstable (LP: #163271), remaining change... * Merge from debian unstable (LP: #163271), remaining changes: - remaining Ubuntu patches in debian/patches: - 88_force-no-pragma-visibility-for-gcc-4.2_4.3 - 88_bz384304_lp117575_linkrecursion_fix_in_startscript - xulrunner diversion (xulrunner.{postinst,prerm,install}) - Maintainer set to Ubuntu MOTU Developers * Drop debian/patches/{68_python25_api_breakage.dpatch, 88_ubuntu_pyginputstream.dpatch,88_ubuntu_pyiinputstream.dpatch} merge by Debian into debian/patches/35_python_2.5.dpatch - update debian/patches/00list * Drop debian/patches/61_python_py_ssize_t_detect now useless - update debian/patches/00list * Fix FTBFS with cairo lib needing Xrender: - add patch 88_bz344818_missing_library_check - update debian/patches/00list * Fix FTBFS with newer nss allowing to build with either old nss 3.11 or upcoming 3.12. - add patch 88_bz399589_fix_missing_symbol_with_new_nss - update debian/patches/00list * Update debian/patches/99_configure.dpatch	Fabien Tassin	1.8.1.9-1ubuntu1	16 years ago
18	debian/control: build depend on ecj instead of ecj-bootstrap... debian/control: build depend on ecj instead of ecj-bootstrap, that doesn't exist anymore.	Alexander Sack	1.8.1.4-2ubuntu5	16 years ago
17	Prepare xul 1.8 to play nicely with forthcoming xulrunner 1.... Prepare xul 1.8 to play nicely with forthcoming xulrunner 1.9 upload: * debian/xulrunner.install: install startup script as /usr/lib/xulrunner/xulrunner instead of /usr/bin/xulrunner * debian/xulrunner.{postinst,prerm}: introduce xulrunner alternative to allow multiple xulrunner versions to be installed on the same system. * debian/patches/88_bz384304_lp117575_linkrecursion_fix_in_startscript.dpatch: adapt patch from bugzilla 384304 to allow deep link recursions of xulrunner start script.	Alexander Sack	1.8.1.4-2ubuntu4	16 years ago
16	* debian/patches/88_ubuntu_pyginputstream.dpatch, * debian/patches/88_ubuntu_pyginputstream.dpatch, debian/patches/88_ubuntu_pyiinputstream.dpatch: drop patches because they are not applied anyway. * debian/patches/88_force-no-pragma-visibility-for-gcc-4.2_4.3.dpatch, debian/patches/00list: add anti ftbfs-on-gcc-4.2_4.3 patch to force use of -fvisibility=hidden instead of pragma push (hidden) even if gcc bugs are not detected. * debian/patches/99_configure.dpatch: refresh configure accordingly.	Alexander Sack	1.8.1.4-2ubuntu3	16 years ago
15	* replacing bogus patches that can cause access to unintiali... * replacing bogus patches that can cause access to unintialized memory and that should have never ended up in here: - Dropped 88_ubuntu_pyginputstream.dpatch - Dropped 88_ubuntu_pyiinputstream.dpatch - Adding 61_python_py_ssize_t_detect.dpatch - Adding 68_python25_api_breakage.dpatch - Update 99_configure.dpatch because 61_python_py_ssize_t_detect.dpatch touches configure.in. New patches that do boundary checks are submitted to bugzilla bug 386610 and debian bug 431483. - update 00list accordingly Remaining Ubuntu Changes: - Adding 61_python_py_ssize_t_detect.dpatch - Adding 68_python25_api_breakage.dpatch - update 00list accordingly - Update 99_configure.dpatch like: 1. dpatch-edit-patch 99_configure.dpatch 2. autoconf2.13 3. exit 0 - debian/control: Change Maintainer/XSBC-Original-Maintainer field.	Alexander Sack	1.8.1.4-2ubuntu2	16 years ago
14	* Merge from Debian unstable. Remaining Ubuntu changes: * Merge from Debian unstable. Remaining Ubuntu changes: + Fixing __x86_64__ and __ia64__ FTBFS - Added 88_ubuntu_pyginputstream.dpatch - Added 88_ubuntu_pyiinputstream.dpatch - update debian/patches/00list + debian/control: Change Maintainer/XSBC-Original-Maintainer field.	Michele Angrisano	1.8.1.4-2ubuntu1	17 years ago
13	Apply the fix for AMD64 also to IA64 Apply the fix for AMD64 also to IA64 (this should hopefully fix the FTBFS on IA64).	Michael Bienia	1.8.1.4-1ubuntu2	17 years ago
12	* Merge from Debian unstable. Remaining Ubuntu changes: * Merge from Debian unstable. Remaining Ubuntu changes: + Fixing __x86_64__ FTBFS - Added 88_ubuntu_pyginputstream.dpatch - Added 88_ubuntu_pyiinputstream.dpatch + debian/control: Change Maintainer/XSBC-Original-Maintainer field.	Arthur Loiret	1.8.1.4-1ubuntu1	17 years ago
11	* Merge from debian unstable, remaining changes: * Merge from debian unstable, remaining changes: - resolve conflict in debian/control + debian/rules - looks like candidate for sync	Alexander Sack	1.8.0.11-4ubuntu1	17 years ago
10	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: + Fixing __x86_64__ FTBFS - Added 100_ubuntu_pyginputstream.dpatch - Added 100_ubuntu_pyiinputstream.dpatch + debian/control: Change Maintainer/XSBC-Original-Maintainer field.	Michael Bienia	1.8.0.10-3ubuntu1	17 years ago
9	* Merge from Debian unstable, remaining changes: * Merge from Debian unstable, remaining changes: + Fixing __x86_64__ FTBFS - Added 100_ubuntu_pyginputstream.dpatch - Added 100_ubuntu_pyiinputstream.dpatch * debian/control: Change Maintainer/XSBC-Original-Maintainer field. * UVF exception: LP: #89561	Michael Bienia	1.8.0.10-1ubuntu1	17 years ago
8	* Fixing __x86_64__ FTBFS * Fixing __x86_64__ FTBFS + Added 100_ubuntu_pyginputstream.dpatch + Added 100_ubuntu_pyiinputstream.dpatch	Stephan Hermann	1.8.0.9-1ubuntu1	17 years ago

Older »