diff options
author | taya <taya> | 2005-04-17 02:19:39 +0000 |
---|---|---|
committer | taya <taya> | 2005-04-17 02:19:39 +0000 |
commit | 9d306d01b5cda3e2d6cb8cefbdf9b48dd6734d86 (patch) | |
tree | 24da4746325c9e196463d69c2de18724e297fe7d /www/firefox | |
parent | 9b94a70f986a804b4cc729c7820a65b693c8f91e (diff) | |
download | pkgsrc-9d306d01b5cda3e2d6cb8cefbdf9b48dd6734d86.tar.gz |
Update firefox & firefox-gtk1 to 1.0.3.
This is a security fix release.
Fixed vulnerabilities are follows:
MFSA 2005-33 Javascript "lambda" replace exposes memory contents
MFSA 2005-34 javascript: PLUGINSPAGE code execution
MFSA 2005-35 Showing blocked javascript: popup uses wrong privilege context
MFSA 2005-36 Cross-site scripting through global scope pollution
MFSA 2005-37 Code execution through javascript: favicons
MFSA 2005-38 Search plugin cross-site scripting
MFSA 2005-39 Arbitrary code execution from Firefox sidebar panel II
MFSA 2005-40 Missing Install object instance checks
MFSA 2005-41 Privilege escalation via DOM property overrides
Diffstat (limited to 'www/firefox')
-rw-r--r-- | www/firefox/Makefile-firefox.common | 5 | ||||
-rw-r--r-- | www/firefox/distinfo | 9 | ||||
-rw-r--r-- | www/firefox/patches/patch-bugzilla288688 | 38 |
3 files changed, 6 insertions, 46 deletions
diff --git a/www/firefox/Makefile-firefox.common b/www/firefox/Makefile-firefox.common index af9cefdf30d..17acbe196a8 100644 --- a/www/firefox/Makefile-firefox.common +++ b/www/firefox/Makefile-firefox.common @@ -1,8 +1,7 @@ -# $NetBSD: Makefile-firefox.common,v 1.14 2005/04/13 13:34:26 taya Exp $ +# $NetBSD: Makefile-firefox.common,v 1.15 2005/04/17 02:19:39 taya Exp $ MOZILLA_BIN= firefox-bin -MOZ_VER= 1.0.2 -PKGREVISION= 2 +MOZ_VER= 1.0.3 EXTRACT_SUFX= .tar.bz2 DISTNAME= firefox-${MOZ_VER}-source diff --git a/www/firefox/distinfo b/www/firefox/distinfo index a1f01659052..84a04117cbe 100644 --- a/www/firefox/distinfo +++ b/www/firefox/distinfo @@ -1,8 +1,8 @@ -$NetBSD: distinfo,v 1.27 2005/04/06 16:00:53 taya Exp $ +$NetBSD: distinfo,v 1.28 2005/04/17 02:19:39 taya Exp $ -SHA1 (firefox-1.0.2/firefox-1.0.2-source.tar.bz2) = 3ad187a4f9b37b63bed29f9548176aea6a4473c3 -RMD160 (firefox-1.0.2/firefox-1.0.2-source.tar.bz2) = 7bcf109ee8b374ef489e69a45ac1dc3b1580e156 -Size (firefox-1.0.2/firefox-1.0.2-source.tar.bz2) = 32760074 bytes +SHA1 (firefox-1.0.3/firefox-1.0.3-source.tar.bz2) = afaf5e7664ff619b30a82e4239a04ce9fd4f1f8b +RMD160 (firefox-1.0.3/firefox-1.0.3-source.tar.bz2) = e160e64ea82b3d992dbd119d72c6b8c602d2a0f2 +Size (firefox-1.0.3/firefox-1.0.3-source.tar.bz2) = 32784300 bytes SHA1 (patch-aa) = 9225a7a2c9b4545e800008169d4d88452c85d1a9 SHA1 (patch-ab) = 0c1f2d6cca09b4dd6b168ed29d84d245967a3369 SHA1 (patch-ac) = 32aa4b92eea19aca07077a292cb759d074026642 @@ -28,7 +28,6 @@ SHA1 (patch-br) = 6311da23ec126fe0959cb19502a22c106f8f975c SHA1 (patch-bs) = 81065130c96bf966b22e6abb767a5b674dcb52cb SHA1 (patch-bt) = 6e3ceb31866dfb0dba81c93446db2b21e1df9baa SHA1 (patch-bu) = db33b8651e3cb1fbf9a18dbe78e1e8288cfda0ee -SHA1 (patch-bugzilla288688) = cebe5ad483a4cfcd55c6be0f0823b75ed1bd4aba SHA1 (patch-bv) = 4f23dfd885131ea866f31370f1421e7c19706860 SHA1 (patch-bw) = fc3a518d3762be6e85104a6dc7fffd5ae1a463c8 SHA1 (patch-bx) = 046e19c9c4b431369411658373b14c1822841d85 diff --git a/www/firefox/patches/patch-bugzilla288688 b/www/firefox/patches/patch-bugzilla288688 deleted file mode 100644 index 02558dbb8b4..00000000000 --- a/www/firefox/patches/patch-bugzilla288688 +++ /dev/null @@ -1,38 +0,0 @@ -$NetBSD: patch-bugzilla288688,v 1.1 2005/04/06 16:00:53 taya Exp $ - -diff -ru ../Orig/mozilla/js/src/jsstr.c ./js/src/jsstr.c ---- ../Orig/mozilla/js/src/jsstr.c 2003-12-22 15:13:07.000000000 +0900 -+++ ./js/src/jsstr.c 2005-04-06 23:33:09.000000000 +0900 -@@ -1378,11 +1378,17 @@ - JSBool ok; - - /* -- * Save the rightContext from the current regexp, since it -- * gets stuck at the end of the replacement string and may -- * be clobbered by a RegExp usage in the lambda function. -+ * Save the regExpStatics from the current regexp, since they may be -+ * clobbered by a RegExp usage in the lambda function. Note that all -+ * members of JSRegExpStatics are JSSubStrings, so not GC roots, save -+ * input, which is rooted otherwise via argv[-1] in str_replace. -+ * -+ * We need to clear moreParens in the top-of-stack cx->regExpStatics -+ * to it won't be possibly realloc'ed, leaving the bottom-of-stack -+ * moreParens pointing to freed memory. - */ -- JSSubString saveRightContext = cx->regExpStatics.rightContext; -+ JSRegExpStatics save = cx->regExpStatics; -+ cx->regExpStatics.moreParens = NULL; - - /* - * In the lambda case, not only do we find the replacement string's -@@ -1460,7 +1466,9 @@ - - lambda_out: - js_FreeStack(cx, mark); -- cx->regExpStatics.rightContext = saveRightContext; -+ if (cx->regExpStatics.moreParens) -+ JS_free(cx, cx->regExpStatics.moreParens); -+ cx->regExpStatics = save; - return ok; - } - #endif /* JS_HAS_REPLACE_LAMBDA */ |