Software bugs

Joey Hess describes the trouble for distros trying to provide security updates for Mozilla:

That’s right, this bug, which is for a security hole that was fixed two weeks ago, is not being dislosed until apparently, August 1st. Same is true for several others of the holes fixed in recent versions. That’s two weeks for distibutions that have to backport these fixes to race against black hats to see who can track down the hole in all the other changes in the new mozilla release, and respectively fix and exploit it.

And so Ubuntu has decided to backport the new mozilla versions into their releases instead of backporting fixes, while Debian stable has decided to bow out of the race. Both understandable decisions in their own contexts.

Popularity: 64% [?]

This entry was posted on Saturday, July 30th, 2005 at 8:46 pm and is filed under Security bug fixes.