firefox 1.5.dfsg+1.5.0.10-0ubuntu0.6.06.1 source package in Ubuntu

Changelog

firefox (1.5.dfsg+1.5.0.10-0ubuntu0.6.06.1) dapper-security; urgency=low

  * New upstream security update:
  * MFSA2007-01 - Crashes with evidence of memory corruption
    (rv:1.8.0.10/1.8.1.2):
     - CVE-2007-0775 - layout engine crashes
     - CVE-2007-0776 - SVG
     - CVE-2007-0777 - javascript engine corruption
  * MFSA2007-02 - Improvements to help protect against Cross-Site
    Scripting attacks:
     - CVE-2007-0995 - Invalid trailing characters in HTML tag attributes
     - CVE-2007-0996 - Child frame character set inheritance
     - CVE-2006-6077 - Injected password forms
  * MFSA2007-03 aka CVE-2007-0778: Information disclosure through cache
    collisions
  * MFSA2007-04 aka CVE-2007-0779: Spoofing using custom cursor and CSS3
    hotspot
  * MFSA2007-05 aka CVE-2007-0780, CVE-2007-0800: XSS and local file access
    by opening blocked popups
  * MFSA2007-06 aka CVE-2007-0008, CVE-2007-0009: Mozilla Network Security
    Services (NSS) SSLv2 buffer overflow
  * MFSA2007-07 aka CVE-2007-0981: Embedded nulls in location.hostname
    confuse same-domain checks
  * security/nss/lib/freebl/unix_rand.c: dropping preprocessor condition
    as an equivalent check has been introduced upstream (#ifndef LINUX
    -> #ifdef DO_NETSTAT)
  * security/coreconf/rules.mk: adapted patch to changed upstream code base
  * security/coreconf/Linux.mk: dropping ppc64 OS_TEST as it has been
    applied upstream
  * toolkit/components/passwordmgr/base/nsPasswordManager.cpp: adapting
    patch to updated code-base.

 -- Alexander Sack <email address hidden>   Wed, 21 Feb 2007 18:05:00 -0800