firefox: multiple vulnerabilities [LWN.net]

Package(s):

firefox mozilla

CVE #(s):

CVE-2006-0749 CVE-2006-1724 CVE-2006-1727 CVE-2006-1728 CVE-2006-1729 CVE-2006-1730 CVE-2006-1731 CVE-2006-1732 CVE-2006-1733 CVE-2006-1734 CVE-2006-1735 CVE-2006-1737 CVE-2006-1738 CVE-2006-1739 CVE-2006-1740 CVE-2006-1741 CVE-2006-1742

Created:

April 14, 2006

Updated:

June 9, 2006

Description:

There are multiple vulnerabilities in Firefox and related products including Thunderbird, SeaMonkey and the Mozilla Suite. This CERT Advisory contains additional information.

Alerts:

Ubuntu	USN-296-1	2006-06-09
Fedora-Legacy	FLSA:189137-2	2006-06-06
Fedora-Legacy	FLSA:189137-1	2006-06-06
Gentoo	200605-09	2006-05-08
Slackware	SSA:2006-123-02	2006-05-04
Fedora	FEDORA-2006-494	2006-05-03
Fedora	FEDORA-2006-493	2006-05-03
Fedora	FEDORA-2006-491	2006-05-03
Fedora	FEDORA-2006-490	2006-05-03
Fedora	FEDORA-2006-487	2006-05-03
Fedora	FEDORA-2006-495	2006-05-03
Fedora	FEDORA-2006-492	2006-05-03
Fedora	FEDORA-2006-486	2006-05-03
Fedora	FEDORA-2006-489	2006-05-03
Fedora	FEDORA-2006-488	2006-05-03
Ubuntu	USN-276-1	2006-05-03
Slackware	SSA:2006-120-01	2006-05-01
Gentoo	200604-18	2006-04-28
Mandriva	MDKSA-2006:078	2006-04-25
Mandriva	MDKSA-2006:076	2006-04-25
Debian	DSA-1044-1	2006-04-26
SuSE	SUSE-SA:2006:022	2006-04-25
Mandriva	MDKSA-2006:075	2006-04-24
Slackware	SSA:2006-114-01	2006-04-25
Gentoo	200604-12	2006-04-23
Red Hat	RHSA-2006:0330-01	2006-04-21
SuSE	SUSE-SA:2006:021	2006-04-20
Ubuntu	USN-271-1	2006-04-19
Fedora	FEDORA-2006-411	2006-04-18
Fedora	FEDORA-2006-410	2006-04-18
Red Hat	RHSA-2006:0329-01	2006-04-18
Slackware	SSA:2006-107-01	2006-04-17
Red Hat	RHSA-2006:0328-01	2006-04-14

(Log in to post comments)

firefox: multiple vulnerabilities

Posted Apr 27, 2006 15:46 UTC (Thu) by JoeBuck (subscriber, #2330) [Link]

As the CERT advisory makes clear, all of these issues are fixed upstream in version 1.5.0.2 of Firefox. It would be best to put that information up front in the LWN article, so anyone with a slow-moving distributor knows he/she has the option of going direct to mozilla.com for the upgrade.

Ditto for other apps that upstream ships binaries for or that can be built easily with configure, make, make install: it would be appropriate to let people know when there is a security fix in the upstream source tarball and what version number has the fix.