Re: [Security-Discuss] Firefox update MDKSA-2005:174

* Juergen Holm <holm-cReBFXHS9TI9HBOmPq+WUkOITlckZahNbaYZWgcc/[email protected]> [2005-10-10 20:09:01 +0200]:

> >>Any hints?
> >
> >Didn't see this in testing on 3 different machines... not quite sure
> >what the deal here is.  Did you try logging out then logging back in
> >again to try?  Was firefox running when you did the update?
> 
> I had rebooted the Machine and logged in again same result.
> I've then installed the old mozilla-firefox-1.0.2-9.1.102mdk, no problems
> anymore!
> So, there must be something bad in the firefox patches for my (I think
> very mandriva vanilla) environment.
> 
> After a heavy investigations I found the reason why I am in trouble:
> We are automaticaly copy a system wide
> /usr/lib/mozilla-firefox-1.0.2/defaults/pref/firefox.js
> to all of our computers to set up some defaults (proxy, etc).

This doesn't sound very vanilla to me.

> In your last version of firefox mandriva decided to make use of
> 
>    pref("app.build_id", "2005031700");
> 
> But in all previous versions of firefox you are setting this in firefox.js:
> 
>    pref("app.build_id", "0000000000);
> 
> Why in the hell did you do this?
> Is there another (=better) way to setup system wide defaults?

No idea... I'll let Fred reply to this one... he's the expert.  I don't
even know what "app.build_id" is for.

-- 
"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (Darwin)

iD8DBQFDSzGGLrxeMv7jCtQRAjqdAJ0XONdnPq+TPjZKWa2JgqgKAqvtkwCgsgsJ
nbocOrpR5yS7XQX1gb8l8WY=
=dQlo
-----END PGP SIGNATURE-----