328185 - (camino-0.8.5) [meta] tracking bug for Camino 0.8.5 security release for 10.1 users

Status: RESOLVED FIXED

(Camino Graveyard :: General, defect)

Description

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

We dropped support for 10.1 following 0.8.x, but we continue to list it for download for 10.1 folks; there are many known security holes in 0.8.x/Gecko 1.7 and MoFo/MoCo is still patching them for the moment.  

We intend to release one last version with all the security fixes Mo* has made since April 2005 and then put 0.8.x/10.1 support to bed forever (with a note to that effect on release).  (Since there are no strings changes, we can use the existing 0.8.4 ML packages with no work by l10n, except maybe a bit with the readme.)

This bug tracks potential Camino-only security fixes we should include, as well as some bookmarks/history dataloss fixes it would be nice to include, if possible.

Unpatched Secunia dialogue spoofing: bug 298320
Backwards-typing sheet bug with security implications: bug 179307
XPcom component reg that causes history & bookmark loss: bug 286096, 
Assorted smfr fixes for bookmark dataloss and crashes: bug 289769, bug 323847, bug 201506, bug 304565, bug 321886

Note smfr did a lot of bookmark cleanup work without bugs, so that last category may not all be backportable based on the patches present in the bugs.

Comment 1

[Samuel Sidler (old account; do not CC)]

Removing bug 286096 from the dependencies. It involves core files and getting approval for them will be impossible at this point.

Comment 2

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Removing bug 323847 from the list because we can't get it to work; it's more important to use our limited "fuss time" to get bug 179307 working.

Comment 3

[Samuel Sidler (old account; do not CC)]

Status
-------------
bug 179307 - incomplete patch in bug
bug 201506 - todo
bug 289769 - removed since there's no easy checkin
bug 298320 - fixed
bug 304565 - todo
bug 321886 - fixed
bug 328188 - not needed for release

Comment 4

[Smokey Ardisson (offline for a while; not following bugs - do not email)]

Bug 304565 doesn't actually appear until 0.9-something, and the patch doesn't work, so dropping.

So we just need 2 now:

bug 179307 - incomplete patch in bug
bug 201506 - todo

Comment 5

[Samuel Sidler (old account; do not CC)]

We're now waiting for the following:
1) mozilla.org to finalize Gecko 1.7.13
2) Determination (and possibly patch) for bug 201506

Comment 6

[Samuel Sidler (old account; do not CC)]

We're not going to take bug 201506 for 0.8.5. Removing dependency.

Now we're just waiting on Mozilla 1.7.13.

Comment 7

[Samuel Sidler (old account; do not CC)]

Camino 0.8.5 (en and ML) will be released tomorrow.

Closing this bug and marking fixed.