248510 - make Known Vulnerabilities page easier to find

Status: RESOLVED WORKSFORME

(www.mozilla.org :: General, defect)

Description

[Daniel Wang]

> For example it isn't very easy for end users to find out which security holes
> are in which Mozilla Version. There is a list
> (<http://www.mozilla.org/projects/security/known-vulnerabilities.html>) but
> this is hard to find. I think this list should be linked at an easier to find
> place on mozilla.org that end users also can find it without searching for
> hours.

Comment 1

[timeless]

why do end users care?

Comment 2

[Christian :Biesinger (don't email me, ping me on IRC)]

so that they know whether their current mozilla version has known
vulnerabilities and whether they should upgrade?

Comment 3

[Dave Miller [:justdave]]

reassigning endico's bugs to default owner

Comment 4

[Anne (:annevk)]

If they should upgrade (In reply to comment #2)
> so that they know whether their current mozilla version has known
> vulnerabilities and whether they should upgrade?

Isn't that reported separately? (The Mozilla Foundation decides if a security
patch/build is released.)

Comment 5

[Christian :Biesinger (don't email me, ping me on IRC)]

Anne: not sure what you mean... let's say a security problem is found in mozilla
1.7.3... later on, a mozilla 1.7.5 release is made available... now, how do
users know whether it's just stability fixes, or also security fixes that were made?

Comment 6

[Daniel Wang]

worksforme now

Comment 7

[Anne (:annevk)]

I guess that's reported in the release notes or is mentioned in the news which
is linked from the mozilla.org homepage.