Please update to 2.0.13 (HTTPS certificate blacklist)

Bug #743348 reported by Wolfgang Pietsch
272
This bug affects 3 people
Affects Status Importance Assigned to Milestone
seamonkey (Ubuntu)
Fix Released
Medium
Micah Gersten
Hardy
Won't Fix
Medium
Micah Gersten
Karmic
Won't Fix
Medium
Micah Gersten
Lucid
Won't Fix
Medium
Micah Gersten
Maverick
Won't Fix
Medium
Micah Gersten
Natty
Fix Released
Medium
Micah Gersten

Bug Description

Binary package hint: seamonkey

Please make SeaMonkey 2.0.13 available to include the mfsa2011-11 update to HTTPS certificate blacklist, which was the reason for quick firefox 3.6.16 update. Seems to be a major security issue. Iceape 2.0.13 is now on debian unstable.

Revision history for this message
Micah Gersten (micahg) wrote :

Thank you for reporting this to Ubuntu. For those that want this release as soon as possible, it'll be staged at https://launchpad.net/~ubuntu-mozilla-security/+archive/ppa sometime tomorrow.

Changed in seamonkey (Ubuntu):
assignee: nobody → Micah Gersten (micahg)
importance: Undecided → Medium
status: New → In Progress
Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Maverick):
importance: Undecided → Medium
status: New → In Progress
assignee: nobody → Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Lucid):
status: New → In Progress
Changed in seamonkey (Ubuntu Karmic):
status: New → In Progress
Changed in seamonkey (Ubuntu Hardy):
status: New → In Progress
importance: Undecided → Medium
Changed in seamonkey (Ubuntu Karmic):
importance: Undecided → Medium
Changed in seamonkey (Ubuntu Lucid):
importance: Undecided → Medium
Changed in seamonkey (Ubuntu Karmic):
assignee: nobody → Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Hardy):
assignee: nobody → Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Lucid):
assignee: nobody → Micah Gersten (micahg)
Micah Gersten (micahg)
security vulnerability: no → yes
Revision history for this message
NoOp (glgxg) wrote :

Added point(s):
http://www.mozilla.org/security/known-vulnerabilities/seamonkey20.html#seamonkey2.0.13
Fixed in SeaMonkey 2.0.13
MFSA 2011-11 Update to HTTPS certificate blacklist
Fixed in SeaMonkey 2.0.12
MFSA 2011-10 CSRF risk with plugins and 307 redirects
MFSA 2011-08 ParanoidFragmentSink allows javascript: URLs in chrome documents
MFSA 2011-07 Memory corruption during text run construction (Windows)
MFSA 2011-06 Use-after-free error using Web Workers
MFSA 2011-05 Buffer overflow in JavaScript atom map
MFSA 2011-04 Buffer overflow in JavaScript upvarMap
MFSA 2011-03 Use-after-free error in JSON.stringify
MFSA 2011-02 Recursive eval call causes confirm dialogs to evaluate to true
MFSA 2011-01 Miscellaneous memory safety hazards (rv:1.9.2.14/ 1.9.1.17)

It appears that the SeaMonkey maintainers also missed all of the security issues with SeaMonkey 2.0.12.

Revision history for this message
Wolfgang Pietsch (wolfgang-pietsch) wrote :

Installed the seamonkey 2.0.13+nobinonly-0ubuntu0.9.10.1 from ppa (Comment #1) into karmic and for me it's working.

Revision history for this message
Wolfgang Pietsch (wolfgang-pietsch) wrote :

Right now the Ubuntu Mozilla Security PPA contains 2.0.13 for Hardy, Karmic and Lucid. Packages for Maverick and Natty would be nice and should go to -proposed or -security archives. As I stated before, Karmic package is working good, no reason to hide it in PPA anymore. Corresponding Iceape 2.0.13 has been moved to testing (wheezy), also no complains with that. Tx. for attention.

Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Hardy):
status: In Progress → Fix Committed
Changed in seamonkey (Ubuntu Karmic):
status: In Progress → Fix Committed
Changed in seamonkey (Ubuntu Lucid):
status: In Progress → Fix Committed
Changed in seamonkey (Ubuntu Maverick):
status: In Progress → Fix Committed
Micah Gersten (micahg)
Changed in seamonkey (Ubuntu Natty):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package seamonkey - 2.0.13+nobinonly-0ubuntu1

---------------
seamonkey (2.0.13+nobinonly-0ubuntu1) natty; urgency=low

  * New upstream release v2.0.13 (SEAMONKEY_2_0_13_RELEASE)

  * SECURITY UPDATE:
    MFSA-2011-11: Several fraudulent HTTPS certificates were placed on the
    certificate blacklist to prevent their misuse. These could allow an
    attacker to perform a man-in-the-middle attack. (LP: #743348)
    - http://www.mozilla.org/security/announce/2011/mfsa2011-11.html
  * SECURITY UPDATE (2.0.12):
    - http://www.mozilla.org/security/known-vulnerabilities/seamonkey20.html#seamonkey2.0.12
 -- Micah Gersten <email address hidden> Tue, 12 Apr 2011 15:26:18 -0500

Changed in seamonkey (Ubuntu Natty):
status: Fix Committed → Fix Released
Revision history for this message
Micah Gersten (micahg) wrote :

These updates are ready for testing in ppa:ubuntu-mozilla-security. If the community would like to test these (http, https, passwords, flash, printing, java, etc), please comment here after you have tested this functionality and which release was tested.

Changed in seamonkey (Ubuntu Karmic):
status: Fix Committed → Won't Fix
Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

Changed in seamonkey (Ubuntu Maverick):
status: Fix Committed → Won't Fix
Changed in seamonkey (Ubuntu Hardy):
status: Fix Committed → Won't Fix
Changed in seamonkey (Ubuntu Lucid):
status: Fix Committed → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.