Mike Hommey uploaded new packages for iceweasel which fixed the following
security problems:
CVE-2011-2372
Mariusz Mlynski discovered that websites could open a download
dialog - which has "open" as the default action -, while a user
presses the ENTER key.
CVE-2011-2995
Benjamin Smedberg, Bob Clary and Jesse Ruderman discovered crashes
in the rendering engine, which could lead to the execution of
arbitrary code.
CVE-2011-2998
Mark Kaplan discovered an integer underflow in the javascript
engine, which could lead to the execution of arbitrary code.
CVE-2011-2999
Boris Zbarsky discovered that incorrect handling of the
window.location object could lead to bypasses of the same-origin
policy.
CVE-2011-3000
Ian Graham discovered that multiple Location headers might lead to
CRLF injection.
For the oldstable distribution (lenny), this problem has been fixed in
version 1.9.0.19-14 of the xulrunner source package. This update also
marks the compromised DigiNotar root certs as revoked rather then
untrusted.
For the lenny-backports distribution the problems have been fixed in
version 3.5.16-10~bpo50+1.
For the stable distribution (squeeze), this problem has been fixed
inversion 3.5.16-10. This update also marks the compromised DigiNotar
root certs as revoked rather then untrusted.
For the unstable distribution (sid), this problem has been fixed in
version 7.0-1.
Upgrade instructions
--------------------
If you don't use pinning (see [1]) you have to update the package
manually via "apt-get -t lenny-backports install <packagelist>" with
the packagelist of your installed packages affected by this update.
[1] <https://backports.debian.org/Instructions>
We recommend to pin (in /etc/apt/preferences) the backports repository
to 200 so that new versions of installed backports will be installed
automatically.
Package: *
Pin: release a=lenny-backports
Pin-Priority: 200