Opened 2 months ago
Closed 2 months ago
#20888 closed enhancement (fixed)
seamonkey-2.53.20
| Reported by: | Douglas R. Reno | Owned by: | Douglas R. Reno |
|---|---|---|---|
| Priority: | high | Milestone: | 12.3 |
| Component: | BOOK | Version: | git |
| Severity: | normal | Keywords: | |
| Cc: |
Description ¶
New point version
Change History (7)
comment:1 by , 2 months ago
comment:2 by , 2 months ago
Unfortunately all of the build fixes are still required, but this is starting to get code from the 128esr branch of the Mozilla products at least in a different branch. In the other branch though, tweaks for Python 3.12 and Python 3.13, ICU, and Clang have been accumulated, and it looks to be a rebase on top of Firefox 128.
comment:3 by , 2 months ago
For now though, it looks like I'll need to take care of this tonight due to the security issues. :(
Another thing noted during the initial build process is changes to our mozconfig are required (so far, --disable-gconf is no longer supported)
comment:5 by , 2 months ago
| Priority: | normal → high |
|---|
Security fixes:
- CVE-2024-8381: Type confusion when looking up a property name in a "with" block (High)
- CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (Moderate)
- CVE-2024-8383: Firefox did not ask before openings news: links in an external application (Moderate)
- CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions (Moderate)
- CVE-2024-9392: Compromised content process can bypass site isolation (High)
- CVE-2024-9393: Cross-origin access to PDF contents through multipart responses (High)
- CVE-2024-9394: Cross-origin access to JSON contents through multipart responses (High)
- CVE-2024-9401: Memory safety bugs fixed in Firefox 131, Firefox ESR 115.16, Firefox ESR 128.3, Thunderbird 131, and Thunderbird 128.3 (High)
- CVE-2024-9680: Use-after-free in Animation timeline (Critical - exploit in the wild)
- CVE-2024-10458: Permission leak via embed or object elements (High)
- CVE-2024-10459: Use-after-free in layout with accessibility (High)
- CVE-2024-10463: Cross origin video frame leak (Moderate)
- CVE-2024-11694: CSP Bypass and XSS Exposure via Web Compatibility Shims (Moderate)
- CVE-2025-0238: Use-after-free when breaking lines in text (Moderate)
- CVE-2025-0242: Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6 (High)
Surprisingly this is up to date with the Firefox/Thunderbird versions that I'm putting in the book along side this!
comment:6 by , 2 months ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:7 by , 2 months ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Fixed at cbcab3901a43a4e0e9ce9770a5bab4afa1b9b573
SA-12.2-060 issued
What's New in SeaMonkey 2.53.20
SeaMonkey 2.53.20 contains (among other changes) the following changes relative to SeaMonkey 2.53.19:
Additional important security fixes up to Current Firefox 115.19 and Thunderbird 115.19 ESR plus many enhancements have been backported. We will continue to enhance SeaMonkey security in subsequent 2.53.x beta and release versions as fast as we are able to.
If you are using macOS 15.1.x please update to 15.2. Because of a bug in the OS SeaMonkey can not be started via Finder or Dock without workarounds. This applies to older versions too.
We are aware of numerous websites breaking because of only supporting the latest Chrome or Firefox versions. We are trying to address this and progress has been made in a different source code branch but the code is not ready for general distribution yet.