Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4403 > unrolled thread

Thunderbird/Icedove security fixes since ESR 31.8.0

Back to article view | Back to linux.debian.security

Contents

  Thunderbird/Icedove security fixes since ESR 31.8.0 filorin <contact@filorin.fr> - 2015-11-04 18:50 +0100
    Re: Thunderbird/Icedove security fixes since ESR 31.8.0 Guillaume Bernard <contact.guib@laposte.net> - 2015-11-10 19:10 +0100
    Re: Thunderbird/Icedove security fixes since ESR 31.8.0 Guillaume Bernard <contact.guib@laposte.net> - 2015-11-10 20:30 +0100
      Re: Thunderbird/Icedove security fixes since ESR 31.8.0 Weber <kweber33@gmx.de> - 2015-11-19 16:30 +0100

#4403 — Thunderbird/Icedove security fixes since ESR 31.8.0

[Multipart message — attachments visible in raw view] — view raw

Hi there,

Since the last release of Thunderbird/Icedove, version 31.8.0, the 17th
of July 2015, many security advisories have been published by Mozilla.
So, why there isn't an update then ?
Considering that some of them are considered as critical, what are the
reason not to update the package ? Do these advisories only concern
security leaks due to the added functionnalities of TB 38.0 ?

Regards,
-- 
filorin
https://filorin.fr

[toc] | [next] | [standalone]

#4408

[Multipart message — attachments visible in raw view] — view raw

Yep you're right, according to the security tracking system, at least 4
high security issues must be corrected.

https://security-tracker.debian.org/tracker/source-package/icedove

Note that the icedove package has been updated in testing the 7th of
november.

Le 08/11/2015 10:53, Pavlos K. Ponos a écrit :
> Good morning,
> 
> good question that still needs to be answered.
> 
> Regards,
> Pavlos
> 
> *Pavlos K. Ponos*
> 
> Account Manager at nlg GmbH
> PhD Candidate at University of Macedonia
> 
> View Pavlos K. Ponos's profile on LinkedIn
> <https://gr.linkedin.com/pub/pavlos-k-ponos/57/27/5b6>
> 
> My blog: https://howtothelinuxway.wordpress.com/
> 
> --------------------------------------------------------------------------------------------------------------------------------------
> Don't send me documents in the following formats: .doc, .docx, .xls,
> .xlsx, .ppt, .pptx
> Instead, try and use Open Document formats:
> <https://www.libreoffice.org>https://www.libreoffice.org
> Save your money & use a Linux distro:
> <http://distrowatch.com/>http://distrowatch.com/
> --------------------------------------------------------------------------------------------------------------------------------------
> 
> On 11/04/2015 07:43 PM, filorin wrote:
>> Hi there,
>>
>> Since the last release of Thunderbird/Icedove, version 31.8.0, the 17th
>> of July 2015, many security advisories have been published by Mozilla.
>> So, why there isn't an update then ?
>> Considering that some of them are considered as critical, what are the
>> reason not to update the package ? Do these advisories only concern
>> security leaks due to the added functionnalities of TB 38.0 ?
>>
>> Regards,
> 

-- 
Guillaume Bernard

[toc] | [prev] | [next] | [standalone]

#4409

[Multipart message — attachments visible in raw view] — view raw

Yep you're right, according to the security tracking system, at least 4
high security issues must be corrected.

https://security-tracker.debian.org/tracker/source-package/icedove

Note that the icedove package has been updated in testing the 7th of
november.

Le 08/11/2015 10:53, Pavlos K. Ponos a écrit :
> Good morning,
> 
> good question that still needs to be answered.
> 
> Regards,
> Pavlos
> 
> *Pavlos K. Ponos*
> 
> Account Manager at nlg GmbH
> PhD Candidate at University of Macedonia
> 
> View Pavlos K. Ponos's profile on LinkedIn
> <https://gr.linkedin.com/pub/pavlos-k-ponos/57/27/5b6>
> 
> My blog: https://howtothelinuxway.wordpress.com/
> 
> --------------------------------------------------------------------------------------------------------------------------------------
> Don't send me documents in the following formats: .doc, .docx, .xls,
> .xlsx, .ppt, .pptx
> Instead, try and use Open Document formats:
> <https://www.libreoffice.org>https://www.libreoffice.org
> Save your money & use a Linux distro:
> <http://distrowatch.com/>http://distrowatch.com/
> --------------------------------------------------------------------------------------------------------------------------------------
> 
> On 11/04/2015 07:43 PM, filorin wrote:
>> Hi there,
>>
>> Since the last release of Thunderbird/Icedove, version 31.8.0, the 17th
>> of July 2015, many security advisories have been published by Mozilla.
>> So, why there isn't an update then ?
>> Considering that some of them are considered as critical, what are the
>> reason not to update the package ? Do these advisories only concern
>> security leaks due to the added functionnalities of TB 38.0 ?
>>
>> Regards,
> 

-- 
Guillaume Bernard

[toc] | [prev] | [next] | [standalone]

#4421

Hi

i only can imagine,  that mozilla or developers are  under control
of "zero day" companies or other services .



if this is so, i hope to get soon a better browser
with less code and better security.

This bug desaster will never stop ! sec. holes are a feature not a
mistake" / bug.
I think in 70% of any software.(upgrade reasons etc...)


paris showed us again,  that backdoored software cannot save lifes!

But agents want the software to be buggy and full with backdoors !

This is nonsense !


2.

Another mistakes of mozilla since many years:

-They put more and more code in one tool,
better would be to split firefox in different "mods"

sec mod, dev mod, player mod, what else....
minimal mod,

-They change config parameters too fast in every new release.


- In some cases they dont explain functions the wiki.

- They use closed source in the upload binary


-They release new code too fast and with too less quality testing; the
community  could not do that good enough as we see in many cases.


-Firefox 1.0 was  a 1 or 2 MB big file  and it was good for surfing in
the web.
Not every Grandma needs a network analyser .
But Grandma doesnt want to get the bugs from this analyser or else
....PDF Viewer...


- I Never saw a slower PDF Viewer like the new from mozilla.
Yes,  i know before that there will come bugs soon.And they came

But Mozilla releases and releases and releases....Its frustrating !
What people work there?
Testers ? Hobby coder?

Its nonsense to integrate any and many viewers and special tools in the
browser.


Its better to check (all!) add-ons and let the users decide what they
need or not.


- "Amazing blog"   :


https://blog.mozilla.org/security/author/dveditzmozillacom/article

https://blog.mozilla.org/security/category/press/


Wow!

so much information!?????



2.1

For debian it would be better NOT to follow any
new code from mozilla   anymore.
And to fix ONE Release for a long time.
Or to start  up a totally new browser system  for linux.

how to do this is if google is sponsor from debian and mozilla ?

STOP now the nearing end of free software!


regards


>> On 11/04/2015 07:43 PM, filorin wrote:
>>> Hi there,
>>>
>>> Since the last release of Thunderbird/Icedove, version 31.8.0, the 17th
>>> of July 2015, many security advisories have been published by Mozilla.
>>> So, why there isn't an update then ?
>>> Considering that some of them are considered as critical, what are the
>>> reason not to update the package ? Do these advisories only concern
>>> security leaks due to the added functionnalities of TB 38.0 ?
>>>
>>> Regards,
>>
> 

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web