[asac@debian.org: Re: ffox 1.5.0.2/1.0.8 CVE-Ids, MFSAs and Bugzilla bugs]

[Alexander Sack]

On Sun, Apr 16, 2006 at 10:04:36AM +0200, Mike Hommey wrote:
> 
> 1.0.4-2sarge3 is basically a 1.0.6. 1.0.4-2sarge5 is that plus some more
> security patches. Your patches are against 1.0.7.  There must have been
> some more changes between 1.0.6 and 1.0.7 than those security patches we
> applied. Maybe they're security related and we missed them...

The problem with jsexn.c was due to a messed up checkin file on my
side. Nevertheless, I cannot tell what happened to your jsobj.c and
jsscript.c files. I tried the patches for a sarge5 testbuild I had 
still lying around here and it applied cleanly. 

Anyway, I added two patches [1] that bring those files back to
upstream state. The new, "ready to apply" patchset is available here:

 http://people.debian.org/~asac/aviary1.0.8b_ready_pack.tar.gz

Please do a testbuild applying those patches and let me know of any
regressions you encounter.

In the meantime I will finalize the documentation, so I guess the
final patchset will be ready in a day or two.


[1] - 01_jsobj.c_debian_to_3.155.2.1.4.6.2.11.patch, 
      01_jsscript.c_debian_to_3.60.16.6.patch

 - Alexander

-- 
 GPG messages preferred.    |  .''`.  ** Debian GNU/Linux **
 Alexander Sack             | : :' :      The  universal
 asac at debian.org            | `. `'      Operating System
 http://www.asoftsite.org/  |   `-    http://www.debian.org/