Received: by mail.netbsd.org (Postfix, from userid 605) id 27EA684D7A; Mon, 27 Nov 2017 23:36:41 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id A54DE84D33 for ; Mon, 27 Nov 2017 23:36:40 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id UqEEaS5LuvCT for ; Mon, 27 Nov 2017 23:36:40 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.netbsd.org [199.233.217.197]) by mail.netbsd.org (Postfix) with ESMTP id 1D64884C8D for ; Mon, 27 Nov 2017 23:36:40 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 18611FB40; Mon, 27 Nov 2017 23:36:40 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1511825800286460" MIME-Version: 1.0 Date: Mon, 27 Nov 2017 23:36:40 +0000 From: "Ryo ONODERA" Subject: CVS commit: pkgsrc/mail/thunderbird To: pkgsrc-changes@NetBSD.org Reply-To: ryoon@netbsd.org X-Mailer: log_accum Message-Id: <20171127233640.18611FB40@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1511825800286460 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="UTF-8" Module Name: pkgsrc Committed By: ryoon Date: Mon Nov 27 23:36:40 UTC 2017 Modified Files: pkgsrc/mail/thunderbird: Makefile distinfo Log Message: Update to 52.5.0 Changelog: #CVE-2017-7828: Use-after-free of PressShell while restyling layout Reporter Nils Impact critical Description A use-after-free vulnerability can occur when flushing and resizing layout because the PressShell object has been freed while still in use. This results in a potentially exploitable crash during these operations. References Bug 1406750 Bug 1412252 #CVE-2017-7830: Cross-origin URL information leak through Resource Timing API Reporter Jun Kokatsu Impact high Description The Resource Timing API incorrectly revealed navigations in cross-origin iframes. This is a same-origin policy violation and could allow for data theft of URLs loaded by users. References Bug 1408990 #CVE-2017-7826: Memory safety bugs fixed in Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5 Reporter Mozilla developers and community Impact critical Description Mozilla developers and community members Christian Holler, David Keeler, Jon Coppeard, Julien Cristau, Jan de Mooij, Jason Kratzer, Philipp, Nicholas Nethercote, Oriol Brufau, André Bargull, Bob Clary, Jet Villegas, Randell Jesup, Tyson Smith, Gary Kwong, and Ryan VanderMeulen reported memory safety bugs present in Firefox 56, Firefox ESR 52.4, and Thunderbird 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. References Memory safety bugs fixed in Firefox 57, Firefox ESR 52.5, and Thunderbird 52.5 To generate a diff of this commit: cvs rdiff -u -r1.199 -r1.200 pkgsrc/mail/thunderbird/Makefile cvs rdiff -u -r1.193 -r1.194 pkgsrc/mail/thunderbird/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1511825800286460 Content-Disposition: inline Content-Length: 2129 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/mail/thunderbird/Makefile diff -u pkgsrc/mail/thunderbird/Makefile:1.199 pkgsrc/mail/thunderbird/Makefile:1.200 --- pkgsrc/mail/thunderbird/Makefile:1.199 Thu Nov 23 17:20:02 2017 +++ pkgsrc/mail/thunderbird/Makefile Mon Nov 27 23:36:39 2017 @@ -1,9 +1,8 @@ -# $NetBSD: Makefile,v 1.199 2017/11/23 17:20:02 wiz Exp $ +# $NetBSD: Makefile,v 1.200 2017/11/27 23:36:39 ryoon Exp $ DISTNAME= thunderbird-${TB_VER}.source PKGNAME= thunderbird-${TB_VER} -TB_VER= 52.4.0 -PKGREVISION= 1 +TB_VER= 52.5.0 CATEGORIES= mail MASTER_SITES= ${MASTER_SITE_MOZILLA:=thunderbird/releases/${TB_VER}/source/} EXTRACT_SUFX= .tar.xz Index: pkgsrc/mail/thunderbird/distinfo diff -u pkgsrc/mail/thunderbird/distinfo:1.193 pkgsrc/mail/thunderbird/distinfo:1.194 --- pkgsrc/mail/thunderbird/distinfo:1.193 Fri Nov 17 00:49:20 2017 +++ pkgsrc/mail/thunderbird/distinfo Mon Nov 27 23:36:39 2017 @@ -1,9 +1,9 @@ -$NetBSD: distinfo,v 1.193 2017/11/17 00:49:20 ryoon Exp $ +$NetBSD: distinfo,v 1.194 2017/11/27 23:36:39 ryoon Exp $ -SHA1 (thunderbird-52.4.0.source.tar.xz) = a51299181996abb6b861a7a5e41a770ef357ceb4 -RMD160 (thunderbird-52.4.0.source.tar.xz) = 09e960c97f13eaf0818cfce0b573ef94f371ad92 -SHA512 (thunderbird-52.4.0.source.tar.xz) = 6ac39cecca9e53b51754d7a8bd7cae228d197eb234b03a2386c16fd665f4f7a67f10bbdf981c20b3f7a21a5ef67e2771154a3dd9f249c6a884c48a9e59bcfc78 -Size (thunderbird-52.4.0.source.tar.xz) = 228561704 bytes +SHA1 (thunderbird-52.5.0.source.tar.xz) = c06e4ba0bf2a8bdcc3daca4b71e9d455aaa9ce7d +RMD160 (thunderbird-52.5.0.source.tar.xz) = aff0a4113a56406d3de5c608c2a1ed57fdd6c339 +SHA512 (thunderbird-52.5.0.source.tar.xz) = b9b599e5853887bd518e5a57f6fd04751bb78f553f97b260cd9ba7268c4cff307be40b81b00f1320f5a5156e5c67115595b2d389f931c265d0c3448f56fb8319 +Size (thunderbird-52.5.0.source.tar.xz) = 230282080 bytes SHA1 (patch-calendar_lightning_Makefile.in) = 02a1528f2da82f1d4ff4931a7d7dc8227b7fa9f2 SHA1 (patch-calendar_lightning_build_universal.mk) = 86dc2c6b4f9feb835570111078aa5d08a389d0da SHA1 (patch-calendar_providers_gdata_Makefile.in) = 0e90ddc9aecc817b0b150bbc37d23ddec97b093e --_----------=_1511825800286460--