Debian DSA-1756-1 Moderate: Xulrunner Remote Exploits Detected

CVE-2009-1169

Security researcher Guido Landi discovered that a XSL stylesheet could
be used to crash the browser during a XSL transformation. An attacker
could potentially use this crash to run arbitrary code on a victim's
computer.

CVE-2009-1044

Security researcher Nils reported via TippingPoint's Zero Day Initiative
that the XUL tree method _moveToEdgeShift was in some cases triggering
garbage collection routines on objects which were still in use. In such
cases, the browser would crash when attempting to access a previously
destroyed object and this crash could be used by an attacker to run
arbitrary code on a victim's computer.

Note that after installing these updates, you will need to restart any
packages using xulrunner, typically iceweasel or epiphany.

For the stable distribution (lenny), these problems have been fixed in version
1.9.0.7-0lenny2.

As indicated in the Etch release notes, security support for the
Mozilla products in the oldstable distribu...