mozilla-thunderbird 1.0.2-2.sarge1.0.8a is available too.

[Martin Schulze]

Alexander Sack wrote:
> On Mon, Jul 24, 2006 at 06:53:57PM +0200, Mike Hommey wrote:
> > On Mon, Jul 24, 2006 at 04:29:14PM +0200, Alexander Sack <asac at jwsdot.com> wrote:
> > > On Mon, Jul 24, 2006 at 04:13:10PM +0200, Martin Schulze wrote:
> > > > > This release covers the same issues as mozilla sarge7.1 ... so you
> > > > > can use the same advisory for it.
> > > > 
> > > > Great.
> > > > 
> > > 
> > > ... for sid the issues are fixed since thunderbird 1.5.0.4-1.
> > 
> > ... and xulrunner 1.5.0.4-1 for galeon and epiphany.
> > 
> 
> How should we deals with those derivates in future? Shouldn't we
> mention them in the advisory of the package they depend upon? Or
> should we assume that gecko users are smart enough to realize that
> they are affected too?

Imho we should mention them (if we don't forget) in advisories for
those packages that they replace.  In this case, they should've been
mentioned in the advisories for Mozilla and Firebird.  Now they're
mentioned in Thunderbird, which is better than nothing, but not perfect,
but that's life.

(don't consider users to be smart enough - many are, but too many aren't)

Regards,

	Joey

-- 
Long noun chains don't automatically imply security.  -- Bruce Schneier