← Back to branch summary

~ubuntu-branches/ubuntu/lucid/seamonkey/lucid-security

« back to all changes in this revision

Viewing changes to modules/libpref/src/init/all.js

  • Committer: Bazaar Package Importer
  • Author(s): Alexander Sack
  • Date: 2008-11-26 14:54:21 UTC
  • mfrom: (1.1.6 upstream)
  • Revision ID: james.westby@ubuntu.com-20081126145421-qpjfr14j0sulg9le
Tags: 1.1.13+nobinonly-0ubuntu1
https://launchpad.net/bugs/297789
* New security upstream release: 1.1.13 (LP: #297789)
  - CVE-2008-4582: Information stealing via local shortcut files
  - CVE-2008-5012: Image stealing via canvas and HTTP redirect
  - CVE-2008-5013: Arbitrary code execution via Flash Player dynamic module unloading
  - CVE-2008-5014: Crash and remote code execution via __proto__ tampering
  - CVE-2008-5017: Browser engine crash - Firefox 2 and 3
  - CVE-2008-5018: JavaScript engine crashes - Firefox 2 and 3
  - CVE-2008-5019: XSS and JavaScript privilege escalation via session restore
  - CVE-2008-0017: Buffer overflow in http-index-format parser
  - CVE-2008-5021: Crash and remote code execution in nsFrameManager
  - CVE-2008-5022: nsXMLHttpRequest::NotifyEventListeners() same-origin violation
  - CVE-2008-5023: -moz-binding property bypasses security checks on codebase principals
  - CVE-2008-5024: Parsing error in E4X default namespace
  - CVE-NOTASSIGN (MFSA2008-59): Script access to .documentURI and .textContent in mail

* re-run autoconf2.13 to update configure patch to changed upstream codebase
  - update debian/patches/99_configure.patch

Show diffs side-by-side

added added

removed removed

Lines of Context:
modules/libpref/src/init/all.js
315
315
pref("capability.policy.mailnews.*.getAttribute", "noAccess");
316
316
pref("capability.policy.mailnews.HTMLDivElement.getAttribute", "sameOrigin");
317
317
pref("capability.policy.mailnews.*.getAttributeNS", "noAccess");
 
318
pref("capability.policy.mailnews.*.getAttributeNode", "noAccess");
 
319
pref("capability.policy.mailnews.*.getAttributeNodeNS", "noAccess");
318
320
pref("capability.policy.mailnews.*.getNamedItem", "noAccess");
319
321
pref("capability.policy.mailnews.*.getNamedItemNS", "noAccess");
320
322
pref("capability.policy.mailnews.*.host.get", "noAccess");
328
330
pref("capability.policy.mailnews.*.src.get", "noAccess");
329
331
pref("capability.policy.mailnews.*.substringData.get", "noAccess");
330
332
pref("capability.policy.mailnews.*.text.get", "noAccess");
 
333
pref("capability.policy.mailnews.*.textContent", "noAccess");
331
334
pref("capability.policy.mailnews.*.title.get", "noAccess");
332
335
pref("capability.policy.mailnews.DOMException.toString", "noAccess");
333
336
pref("capability.policy.mailnews.HTMLAnchorElement.toString", "noAccess");
334
337
pref("capability.policy.mailnews.HTMLDocument.domain", "noAccess");
335
338
pref("capability.policy.mailnews.HTMLDocument.URL", "noAccess");
 
339
pref("capability.policy.mailnews.*.documentURI", "noAccess");
336
340
pref("capability.policy.mailnews.Location.toString", "noAccess");
337
341
pref("capability.policy.mailnews.Range.toString", "noAccess");
338
342
pref("capability.policy.mailnews.Window.blur", "noAccess");