security upgrade of seamonkey 1.1.12

Here is the full debdiff for intrepid. There's no packaging change, just the upstream bump.
Preview debs are in my PPA as seamonkey_1.1.12+nobinonly-0ubuntu1~fta1

Here is a diffstat of that debdiff:

ix:~/tmp$ diffstat seamonkey_1.1.11+nobinonly-0ubuntu1--1.1.12+nobinonly-0ubuntu1.debdiff
 browser/config/version.txt | 2
 client.mk | 10
 config/milestone.txt | 2
 content/base/src/nsDocument.cpp | 1
 content/base/src/nsDocument.h | 5
 content/base/src/nsXMLHttpRequest.cpp | 5
 content/html/content/src/Makefile.in | 1
 content/html/content/src/nsHTMLTableCellElement.cpp | 4
 content/xbl/src/nsXBLService.cpp | 10
 content/xml/document/src/nsXMLDocument.cpp | 48 -
 content/xml/document/src/nsXMLDocument.h | 1
 debian/changelog | 15
 dom/src/base/nsGlobalWindow.cpp | 58 +
 dom/src/base/nsJSUtils.cpp | 42 -
 dom/src/base/nsJSUtils.h | 3
 extensions/schema-validation/src/nsSchemaValidator.cpp | 21
 extensions/schema-validation/src/nsSchemaValidatorUtils.cpp | 56 +
 extensions/schema-validation/src/nsSchemaValidatorUtils.h | 12
 extensions/schema-validation/tests/schema.html | 11
 extensions/transformiix/source/xpath/XFormsFunctionCall.cpp | 185 ++++++
 extensions/transformiix/source/xpath/XFormsFunctions.h | 48 -
 extensions/transformiix/source/xpath/nsIXFormsUtilityService.h | 43 +
 extensions/transformiix/source/xpath/nsXFormsXPathEvaluator.cpp | 20
 extensions/transformiix/source/xpath/txXPathAtomList.h | 6
 extensions/transformiix/source/xslt/txMozillaTextOutput.cpp | 17
 extensions/transformiix/source/xslt/txMozillaXMLOutput.cpp | 11
 extensions/xforms/Makefile.in | 1
 extensions/xforms/install.rdf | 1
 extensions/xforms/nsIModelElementPrivate.idl | 8
 extensions/xforms/nsXFormsAtoms.cpp | 4
 extensions/xforms/nsXFormsAtoms.h | 1
 extensions/xforms/nsXFormsDOMEvent.cpp | 23
 extensions/xforms/nsXFormsDOMEvent.h | 5
 extensions/xforms/nsXFormsInsertDeleteElement.cpp | 9
 extensions/xforms/nsXFormsInstanceElement.cpp | 186 ++++--
 extensions/xforms/nsXFormsInstanceElement.h | 7
 extensions/xforms/nsXFormsModelElement.cpp | 15
 extensions/xforms/nsXFormsSchemaValidator.cpp | 20
 extensions/xforms/nsXFormsSchemaValidator.h | 3
 extensions/xforms/nsXFormsSubmissionElemen...

Here are all the links to the MFSAs giving links to upstream bugzilla.

MFSA 2008-46 Heap overflow when canceling newsgroup message
http://www.mozilla.org/security/announce/2008/mfsa2008-46.html

MFSA 2008-45 XBM image uninitialized memory reading
http://www.mozilla.org/security/announce/2008/mfsa2008-45.html

MFSA 2008-44 resource: traversal vulnerabilities
http://www.mozilla.org/security/announce/2008/mfsa2008-44.html

MFSA 2008-43 BOM characters stripped from JavaScript before execution
http://www.mozilla.org/security/announce/2008/mfsa2008-43.html

MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
http://www.mozilla.org/security/announce/2008/mfsa2008-42.html

MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
http://www.mozilla.org/security/announce/2008/mfsa2008-41.html

MFSA 2008-40 Forced mouse drag
http://www.mozilla.org/security/announce/2008/mfsa2008-40.html

MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation
http://www.mozilla.org/security/announce/2008/mfsa2008-38.html

MFSA 2008-37 UTF-8 URL stack buffer overflow
http://www.mozilla.org/security/announce/2008/mfsa2008-37.html

Here is the tarball, as from "debian/rules get-orig-source"

Here is the full debdiff for hardy.

This bug was fixed in the package seamonkey - 1.1.12+nobinonly-0ubuntu1

---------------
seamonkey (1.1.12+nobinonly-0ubuntu1) intrepid; urgency=low

  * New security upstream release: 1.1.12 (LP: #276437)
    - CVE-2008-4070: Heap overflow when canceling newsgroup message
    - CVE-2008-4069: XBM image uninitialized memory reading
    - CVE-2008-4067..4068: resource: traversal vulnerabilities
    - CVE-2008-4065..4066: BOM characters stripped from JavaScript before execution
    - CVE-2008-4061..4064: Crashes with evidence of memory corruption
    - CVE-2008-4058..4060: Privilege escalation via XPCnativeWrapper pollution
    - CVE-2008-3837: Forced mouse drag
    - CVE-2008-3835: nsXMLDocument::OnChannelRedirect() same-origin violation
    - CVE-2008-0016: UTF-8 URL stack buffer overflow

 -- Fabien Tassin <email address hidden> Tue, 30 Sep 2008 00:41:24 +0200

Can someone comment on the testing done for the hardy upload?

i tested the browser and mail component for most common use cases (like AJAX, IMAP etc.). No problems.

Thanks for the work on the Hardy update.

As discussed on IRC. The debdiff for hardy is nearly 632,000 lines long. The vast majority of this is from nss-fips, which is apparently new. From what I can tell, this code is now being used based on changes in 80_security_build.patch. Apparently this is to fix upstream https://bugzilla.mozilla.org/show_bug.cgi?id=419030. Are the > 600,000 lines of newly compiled code really needed for this update? What testing has been done to show there are no regressions, especially in regards to the NSS related functionality?

to be precise, those nss changes are visible in the ***context*** of 80_security_build.patch but are not part of what that patch is really addressing.

Those nss changes are from https://bugzilla.mozilla.org/show_bug.cgi?id=419030 which took the form of an import of the main nss branch (a stable tag) to the main gecko core branch (the 1.8 branch). This is the usual way for NSS fixes to enter mozilla.

I didn't test the OCSP code per say, but I did test various NSS related features such as cert management and navigation on various https sites.

As discussed on IRC-- seamonkey on hardy is built with system nss and nspr4, and the nss-fips import is not used. Buildlogs and resulting binaries also show this to be true. 80_security_build.patch is also obsolete on systems that build with system nss and nspr4, and what it patches for nss are not used by the hardy build system. Proceeding with the upload.

Thanks for your work on this!