Re: Mozilla products in Debian
On 2010-11-05 17:48 +0100, Camaleón wrote:
> On Fri, 05 Nov 2010 17:00:13 +0100, Sven Joachim wrote:
>
>> That is true, but the Debian iceweasel/xulrunner maintainer and the
>> security team backport security fixes.
>
> How is that possible? :-?
>
> As soon as Mozilla stopped offering security patches and left tracking
> 3.0.x branch there can be "hidden" bugs nor Mozilla nor Debian can be
> aware of.
There also can be^W^W are hidden bugs in the 3.6 branch which Mozilla
and Debian are not aware of. Of course there is the possibility that in
the meantime Mozilla had inadvertently fixed some security bug in the
3.5/3.6 branches without knowing it, so that only 3.0 is vulnerable.
>> Note that most of the problems
>> are not specific to iceweasel and affect all browsers based on
>> xulrunner, so they are fixed in the xulrunner-1.9 package which is
>> updated rather frequently.
>
> Mmm, current xulrunner upstream release is 1.9.2 that matches Firefox
> 3.6. Now I've got installed 1.9.0.19-6 (matching my icedove version).
Reading the Debian changelog for that should give you a good idea what
security bugs got fixed.
> Do you think Debian packages include all these bug fixes?
>
> http://www.mozilla.org/security/known-vulnerabilities/firefox30.html
No, MFSA 2009-11 is not fixed (that is a Firefox-only bug). The others
should be fixed, but I did not check everything myself.
>>> Hopefully there is "backports" holding these packages, but for Mozilla
>>> products (which are included in the regular repo) should not be needed
>>> - to be backported- at all: lenny users should have received 3.5
>>> release by means of the security repo.
>>
>> So that half of their installed extensions are broken after the upgrade?
>> Does not seem to be a very good idea to me.
>
> I prefer having no extensions at all than browsing the web with an
> unsupported browser :-). Anyway, you could choose not updating Iceweasel
> and keep the old branch...
Which is what quite a few people would do, I fear. The current
situation where the old version still gets security updates from Debian
while newer versions are available from lenny-backports is IMO better.
Sven
Reply to: