[rock-user] [Security Announcement] firefox (RLSA-20060801-01)

This is a ROCK Linux Security Announcement.

Package: firefox
Announcement ID: RLSA-20060801-01
Date: 2006-08-01
Affected Distributions: Crystal, LiveCD
Affected Releases: ROCK 3
Cross References:  MFSA 2006-44, MFSA 2006-45, MFSA 2006-46, MFSA
2006-48, MFSA 2006-50, MFSA 2006-51, MFSA 2006-55
Fixed at trunk revision: 7773

Content of this advisory:
1) Problem Description
2) Solution or Work-Around
3) Special instructions and notes
4) Updateing your source tree
5) Source package update
6) Binary package update

--------------------------------------------------------------------------------

1) Problem Description
There are multiple issues with firefox versions prior 1.5.0.5

MFSA 2006-55  Crashes with evidence of memory corruption (rv:1.8.0.5)
MFSA 2006-51  Privilege escalation using named-functions and redefined
"new Object()"
MFSA 2006-50 JavaScript engine vulnerabilities
MFSA 2006-48 JavaScript new Function race condition
MFSA 2006-46  Memory corruption with simultaneous events
MFSA 2006-45 Javascript navigator Object Vulnerability
MFSA 2006-44 Code execution through deleted frame reference


2) Solution or Workaround
There is no known workaround. Please update the package.

3) Special instruction and notes
none

4) Updateing your source tree
If you are using a subversion checkout of trunk, run:
 svn up

If you are using submaster run,
 sm sync
to merge the update from trunk into your tree

5) Source package update
As a user of an affected distribution you can update this package by
rebuilding it on your machine
run
 rocket updsrc
to update your local sources and
 rocket emerge firefox
to install the updated package

6) Binary package update
Binary packages will be available soon for ROCK 3 at

http://gems.rocklinux.org/repo/ROCK3/TRUNK-x86-pentium-mmx-32-crystal/pkgs

Follow the instructions at
https://www.rocklinux.net/wiki/ROCK3#Upgrading_from_ROCK3_Crystal_RCs
to update the binary package.