Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Synopsis
========
A crash vulnerability was found in firefox that were fixed with the firefox 
2.0.0.14 release.  Note that their release *lies* and there are no new 
releases for thunderbird nor seamonkey.

Background
==========
Firefox is the official web browser release of the Mozilla project.

Description
===========
Fixes for security problems in the JavaScript engine described in  MFSA 
2008-15 (CVE-2008-1237) introduced a stability problem, where some users 
experienced crashes during JavaScript garbage collection. This is being fixed 
primarily to address stability concerns. We have no demonstration that this 
particular crash is exploitable but are issuing this advisory because some 
crashes of this type have been shown to be exploitable in the past.[0]

Affected packages
=================
These vulnerabilities were reported for firefox 2.0.0.13. firefox in all 
grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in stable-rc and stable grimoires.

Resolution
==========
All firefox users should upgrade to the latest available version:
# scribe update
# cast -c firefox

If you maintain your own installation of firefox ouside of sorcery, there are 
patches available from upstream, please visit the bugzilla page[1] for 
information.

References
==========
[0] http://www.mozilla.org/security/announce/2008/mfsa2008-20.html
[1] https://bugzilla.mozilla.org/show_bug.cgi?id=425576
[2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380

-- 
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  http://counter.li.org/  #196285

Attachment: signature.asc
Description: This is a digitally signed message part.