Re: firefox 2.0.0.13

[Josh Bressers <bressers () redhat com>]

> > The advisories should be posted soon.  It is a security update comparable
> > to past ones.
>
> Josh,
>
> Any idea on what Mozilla means by using CVE-2008-1240 in MFSA 2008-18?
> They already list CVE-2008-1195, which is associated with the Sun
> advisory, and that seems like the only issue they're really trying to
> address.

Hi Steve,

That's the one I mailed you about back when I was assigning the CVE ids ;)

The Mozilla advisory doesn't clarify that CVE-2008-1195 is the Sun CVE id
for their java advisory:
http://sunsolve.sun.com/search/document.do?assetkey=1-66-233326-1

This flaw is now fixed in both Java and Firefox (it's debatable who is at
fault here, both the browser and the JRE were doing silly things).

As you gave me the advice that since the codebases are different, they
should get separate ids.  We can always yank CVE-2008-1240 if you wish and
I'll see about getting upstream to remove it from the advisory.

If we're keeping CVE-2008-1240, it would probably be wise of Mozilla to
clarify CVE-2008-1195 is for the JVM.

Thanks.

-- 
    JB