Security bugs are reported here via bugzilla

[George Sherwood <pilot AT beernabeer.com>]

Synopsis
========
A critical security vulnerability has been found in seamonkey 1.1.11
and below.  This vulnerability may allow remote code execution.

Background
==========
Seamonkey is the all-in-one internet application suite of the Mozilla project.

Description
===========
An anonymous researcher, via TippingPoint's Zero Day Initiative program, 
reported a vulnerability in Mozilla's internal CSSValue array data structure. 
The vulnerability was caused by an insufficiently sized variable being used 
as a reference counter for CSS objects. By creating a very large number of 
references to a common CSS object, this counter could be overflowed which 
could cause a crash when the browser attempts to free the CSS object while 
still in use. An attacker could use this crash to run arbitrary code on the 
victim's computer.[0]

Affected packages
=================
These vulnerabilities were reported for seamonkey 1.1.11. Seamonkey in all 
grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All seamonkey users should upgrade to the latest available version:
# scribe update
# cast -c seamonkey

If you maintain your own installation of seamonkey ouside of sorcery, there 
are  patches available from upstream.

References
==========
[0] http://www.mozilla.org/security/announce/2008/mfsa2008-34.html

Attachment: signature.asc
Description: PGP signature