Debian 4.0: DSA-1424-1 Critical Iceweasel Remote Threat

Jesse Ruderman and Petko D. Petkov discovered that the URI handler
for JAR archives allows cross-site scripting.

CVE-2007-5959

Several crashes in the layout engine were discovered, which might
allow the execution of arbitrary code.

CVE-2007-5960

Gregory Fleischer discovered a race condition in the handling of
the "window.location" property, which might lead to cross-site
request forgery.

The Mozilla products in the oldstable distribution (sarge) are no longer
supported with with security updates.

For the stable distribution (etch) these problems have been fixed in
version 2.0.0.10-0etch1.

For the unstable distribution (sid) these problems have been fixed in
version 2.0.0.10-2.

We recommend that you upgrade your iceweasel packages.


Upgrade instructions
- --------------------wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
source...