I uploaded new packages for iceweasel which fixed the following security problems: CVE-2011-2372 Mariusz Mlynski discovered that websites could open a download dialog - which has "open" as the default action -, while a user presses the ENTER key. CVE-2011-2995 Benjamin Smedberg, Bob Clary and Jesse Ruderman discovered crashes in the rendering engine, which could lead to the execution of arbitrary code. CVE-2011-2998 Mark Kaplan discovered an integer underflow in the javascript engine, which could lead to the execution of arbitrary code. CVE-2011-2999 Boris Zbarsky discovered that incorrect handling of the window.location object could lead to bypasses of the same-origin policy. CVE-2011-3000 Ian Graham discovered that multiple Location headers might lead to CRLF injection. For the oldstable distribution (lenny), this problem has been fixed in version 1.9.0.19-14 of the xulrunner source package. This update also marks the compromised DigiNotar root certs as revoked rather then untrusted. For the lenny-backports distribution the problems have been fixed in version 3.5.16-10~bpo50+1. For the stable distribution (squeeze), this problem has been fixed inversion 3.5.16-10. This update also marks the compromised DigiNotar root certs as revoked rather then untrusted. For the unstable distribution (sid), this problem has been fixed in version 7.0-1. Upgrade instructions -------------------- If you don't use pinning (see [1]) you have to update the package manually via "apt-get -t lenny-backports install <packagelist>" with the packagelist of your installed packages affected by this update. [1] <http://backports.debian.org/Instructions> We recommend to pin (in /etc/apt/preferences) the backports repository to 200 so that new versions of installed backports will be installed automatically. Package: * Pin: release a=lenny-backports Pin-Priority: 200
Attachment:
signature.asc
Description: Digital signature