mozilla-thunderbird: security patches and new packages

[Alexander Sack]

On Mon, Oct 10, 2005 at 06:29:19AM +0200, Martin Schulze wrote:
> > 
> > Joey, you still on this?
> 
> Umh, according to my logs, I'm still waiting on the signed .changes
> file from you.
> 
> I could build the package in a chroot myself, though.

attached the changes.


-- 
 GPG messages preferred.   |  .''`.  ** Debian GNU/Linux **
 Alexander Sack            | : :' :      The  universal
 asac at debian.org           | `. `'      Operating System
 http://www.asoftsite.org  |   `-    http://www.debian.org
-------------- next part --------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <asac at debian.org>
Changed-By: Alexander Sack <asac at debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes: 
 mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
 .
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
 .
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
 	     name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   * MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
 	     of "critical" have been released in Mozilla Firefox/Thunderbird
 	     1.0.7 and the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
 	     CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
 	      306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing, tbird is not affected
         applied anyway to keep source in sync.
       + CAN-2005-2702 - Crash on "zero-width non-joiner" sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   * MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
 	     are not correctly protected against interpretation by the
 	     shell. As a result a malicious URL can result in the execution
 	     of shell commands with the privileges of the user. If Firefox
 	     is set as the default handler for web URLs then opening a URL
 	     in another program (for example, links in a mail or chat
 	     client) can result in shell command execution.
     Closes: 329664,329664
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution
Files: 
 303ed28d7dac19a27a47c23819f80bd7 997 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
 79fbaf89373ea1d4698942f289b556d2 210991 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
 fc8572c0a89b914fc288fd638e224213 11550326 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
 ec039bd40938c0d6bb87874cc8703c25 27286 mail optional mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
 a90c517acdcaf177b4585cf8f9e35344 140456 mail optional mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
 ecf0d09362306bcd6c8a65c2e779f792 81696 mail optional mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
 02fbded3b5e503def6c29f32c34b24d1 3497080 mail optional mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDQAAMv8pLOKgkuT8RAp6QAKCY/VbjrWCngixYOdu2MQK2URdpsgCeIeBS
gr2DrdhaXYVioWnS4kjhsPs=
=HZnU
-----END PGP SIGNATURE-----