A ton of security advisories for Wednesday [LWN.net]

Debian has updated nagios-plugins (multiple vulnerabilities), mplayer (multiple vulnerabilities), kernel (multiple vulnerabilities).

Fedora has updated kernel-xen (F7, F8: local root privilege escalation), chmsee (F7, F8: multiple gecko vulnerabilities), tomcat5 (F7, F8: multiple vulnerabilities), wordpress (F7, F8: remote editing via unknown vectors), moin (F7, F8: file overwrite via crafted cookie), xine-lib (F7, F8: arbitrary code execution via crafted FLAC), duplicity (F7, F8: password disclosure), clamav (F7, F8: multiple vulnerabilities), openldap (F7, F8: denial of service), graphviz (F7: buffer overflow in GIF handling), mailman (F7, F8: cross-site scripting), seamonkey (F7, F8: multiple vulnerabilities), epiphany-extensions (F7, F8 (multiple gecko vulnerabilities), firefox (F7, F8: multiple gecko vulnerabilities), devhelp (F7, F8: multiple gecko vulnerabilities), gtkmozembedmm (F7, F8: multiple gecko vulnerabilities, gnome-python2-extras (F7, F8: multiple gecko vulnerabilities), galeon (F7, F8: multiple gecko vulnerabilities), ruby-gnome2 (F7, F8: multiple gecko vulnerabilities), epiphany (F7, F8: multiple gecko vulnerabilities), liferea (F7, F8: multiple gecko vulnerabilities), kazehakase (F7, F8: multiple gecko vulnerabilities), yelp (F7, F8: multiple gecko vulnerabilities), Miro (F7, F8: multiple gecko vulnerabilities), openvrml (F7, F8: multiple gecko vulnerabilities), glib2 (F8: arbitrary code execution), blam (F8: multiple gecko vulnerabilities), gnome-web-photo (F8: multiple gecko vulnerabilities).

Gentoo has updated gnumeric (arbitrary code execution), scponly (multiple vulnerabilities).

Red Hat has updated kernel (local root privilege escalation).

rPath has updated kernel (local root privilege escalation), tk (arbitrary code execution), openldap, openldap-clients, openldap-servers (multiple vulnerabilities).

Slackware has updated kernel (multiple vulnerabilities), firefox, seamonkey (multiple vulnerabilities).

Ubuntu has updated kernel (local root privilege escalation).

(Log in to post comments)

Libraries?

Posted Feb 13, 2008 22:11 UTC (Wed) by dodocaptain (subscriber, #44818) [Link]

Wow, that's a lot of updates due to gecko code...

Based on the number of projects which appear to be duplicating the code, anyone know if there
is any plan to make gecko into a separate library?

Libraries?

Posted Feb 13, 2008 23:43 UTC (Wed) by djpig (subscriber, #18768) [Link]

isn't that already available in XULRunner?

Libraries?

Posted Feb 14, 2008 0:01 UTC (Thu) by edschofield (subscriber, #39993) [Link]

Interesting question. It seems this slashdotter asked the same question 4.5 years ago. This page claims XULRunner will provide a "libxul" (but gives no timeframe).

Libraries?

Posted Feb 14, 2008 1:32 UTC (Thu) by djpig (subscriber, #18768) [Link]

libxul already exists, at least here on my Debian boxes:

$ apt-cache rdepends libxul0d
libxul0d
Reverse Depends:
  xulrunner-gnome-support
  xulrunner
  python-xpcom
  liferea-xulrunner
  libmozillainterfaces-java
  libgtk-mozembed-ruby1.8
  seahorse
  miro
  liferea
  libghc6-mozembed-dev
  libdevhelp-1-0
  epiphany-gecko
  epiphany-extensions
  democracyplayer
  zekr
  yelp
  videolink
  python-gnome2-extras
  liferea-xulrunner
  libswt-mozilla-gtk-3.3-jni
  libgecko2.0-cil
  kazehakase
  hunspell-uz
  hunspell-ne
  hunspell-en-us
  hunspell-de-de
  hunspell-de-ch
  hunspell-de-at
  hunspell-da
  galeon
  epiphany-extensions
  epiphany-browser
  chmsee

(Note: actual output of command edited for brevity)

Libraries?

Posted Feb 15, 2008 13:19 UTC (Fri) by nosnilmot (subscriber, #746) [Link]

In F7 & F8 there is just one copy of the Gecko libs, provided by firefox, but there's no
guaranteed ABI stability between releases so every update requires a rebuild of all users.