Flurry of Security Patches

yggy writes "It's been a hectic day on the security patching front. Microsoft's bulletins for July include patches for three critical vulnerabilities on the same day that Mozilla releases new security updates for Firefox and Thunderbird. Not to be left behind, Apple fixed two Tiger flaws while Oracle issued a critical database server update." (See these separate stories on today's release of Firefox 1.0.5 and the 10.4.2 update from Apple, too.)

Comments

And don't forget...

[Afecks]

...the zlib bug

Non-security fixes in Firefox 1.0.5

[Adam9]

Here's some good info that colfer from this MozillaZine thread dug up:

1.0.5 is mainly a security fix, but I have seen a bunch of non-security fixes creep in also, such as removing the default checkbox "yes" for "make firefox my home page." This looks like a big cleanup for the 1.0.x branch, before 1.1 takes over.

I don't know about the security fixes, besides the medium-risk frame/window spoofing thing (with 1.0.4, you should not open untrusted sites at the same time as sensitive sites...). Here are the non-security fixes (non-security as it seems to me) checked in since 1.0.4:

https://bugzilla.mozilla.org/show_bug.cgi?id=28373 0
"Save As" dialog tries to overwrite link/shortcut (.lnk) file instead of opening the directory/folder

https://bugzilla.mozilla.org/show_bug.cgi?id=29521 0
Tab title different from window title on initial load at gmail

https://bugzilla.mozilla.org/show_bug.cgi?id=28377 7
Right arrow key after selecting autocomplete result no longer uses selected item

https://bugzilla.mozilla.org/show_bug.cgi?id=29123 2
update installer packages should offer unchecked check box for setting start page

https://bugzilla.mozilla.org/show_bug.cgi?id=29106 4
Helper app dialog incomplete for non-nsStandardURL types

https://bugzilla.mozilla.org/show_bug.cgi?id=26553 6
(64-bit only issue)

https://bugzilla.mozilla.org/show_bug.cgi?id=24563 1
Crash loading (particular) .ico file

https://bugzilla.mozilla.org/show_bug.cgi?id=14181 8
Table with large rowspans and colspans hangs the browser

https://bugzilla.mozilla.org/show_bug.cgi?id=28800 6
Drag image across browser windows --> crash

https://bugzilla.mozilla.org/show_bug.cgi?id=29505 2
Obscure Javascript crash

https://bugzilla.mozilla.org/show_bug.cgi?id=29627 0
Default user agent problem (AIX platform only)

https://bugzilla.mozilla.org/show_bug.cgi?id=28081 3
Crash on OS/2 platform

https://bugzilla.mozilla.org/show_bug.cgi?id=29377 8
bookmarks toolbar missing in 2nd opened window, links in second window possibly cause crash

Fx 1.0.5 fixes and NoScript

[Anonymous Coward]

Among the other fixes, Firefox 1.0.5 contains a patch to CAPS (Configurable Access Policies) that finally eliminates crashes reported by users of the NoScript extension. This should make Firefox users even more safe: its "whitelist based pre-emptive script blocking approach prevents exploitation of security vulnerabilities (known and even not known yet!) with no loss of functionality"...

Re:Safari now FAILS "Acid test"

[Kyro]

It only passes if you use a nightly. A shipped release has never passed the acid 2 test.