From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: Unpatched security flaws in GNU IceCat 38 Date: Thu, 04 Aug 2016 12:43:23 +0000 Message-ID: <87shukbt78.fsf@we.make.ritual.n0.is> References: <87lh0dz106.fsf@netris.org> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:45186) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVHzq-0003JH-7m for guix-devel@gnu.org; Thu, 04 Aug 2016 08:43:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bVHzn-0002Pv-TJ for guix-devel@gnu.org; Thu, 04 Aug 2016 08:43:33 -0400 Received: from mithlond.libertad.in-berlin.de ([2001:67c:1400:2490::1]:53981 helo=beleriand.n0.is) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bVHzn-0002Pf-FP for guix-devel@gnu.org; Thu, 04 Aug 2016 08:43:31 -0400 Received: by beleriand.n0.is (OpenSMTPD) with ESMTPSA id 9b37e286 TLS version=TLSv1/SSLv3 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO for ; Thu, 4 Aug 2016 12:43:29 +0000 (UTC) In-Reply-To: List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: guix-devel@gnu.org Ricardo Wurmus writes: > Mark H Weaver writes: > >> I'm sorry to report that GNU IceCat 38 can no longer be safely used, due >> to critical security flaws that are believed to allow remote code >> execution. I was unable to backport upstream fixes from 45.3 to 38. >> >> Until IceCat 45.3 is available, I recommend that you use Epiphany. > > Thanks, Mark, for the heads-up. > > Since our package for Conkeror also uses IceCat under the hood I suppose > our version of Conkeror also cannot be safely used at this point. > > ~~ Ricardo This is bad news. Should we consider the efforts and get torbrowser packaged as I wrote about in the torbrowser thread, which is now at 45.3.0 with release torbrowser-6.0.3 to have at least one 45.3x firefox based browser? -- ♥Ⓐ ng0 Current Keys: https://we.make.ritual.n0.is/ng0.txt For non-prism friendly talk find me on http://www.psyced.org