Project

General

Profile

Feature #6496

Drop sqlite3, nss and nspr backports from our APT repository

Added by intrigeri almost 6 years ago. Updated over 5 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
-
Target version:
Start date:
12/15/2013
Due date:
12/29/2013
% Done:

100%

Feature Branch:
feature/torbrowser-24.2.0esr-1+tails1
Type of work:
Code
Blueprint:
Starter:
No
Affected tool:
Browser

Description

In bugfix/use-our-own-sqlite we have imported libnss3, libnss3-1d, libnspr4, libnspr4-0d, libsqlite3-0 and sqlite3 backports into our APT repository, as:

  1. our current browser (24.2.0esr-0+tails3~bpo60+1) depends on these packages;
  2. these packages were dropped from mozilla.debian.net's squeeze-backports repository.

This workaround will (hopefully) be useless once we rebase the browser on Iceweasel 24.2.0esr-1.

Dropping these packages will make us install an old, unsafe version of NSS. We should therefore check that Iceweasel does not use the system one:

  • xulrunner 24.2.0esr-1 ships /usr/lib/xulrunner-24.0/libnss3.so, which the -0 one does not
  • xulrunner 24.2.0esr-1's ldd /usr/lib/xulrunner-24.0/libxul.so says it is linked on the system /usr/lib/libnss3.so, but it says /usr/lib/xulrunner-24.0/libxul.so: /usr/lib/libsmime3.so: version `NSS_3.15' not found (required by /usr/lib/xulrunner-24.0/libxul.so); does this mean it won't / can't use the system NSS?
  • On Tails 0.22, lsof | grep nss | grep icew says it has loaded /lib/libnss_{nis,files,compat}, /usr/lib/libnss3.so and various libs from /usr/lib/nss/; while with 24.2.0esr-1, it has loaded /lib/libnss_{nis,files,compat} and /usr/lib/xulrunner-24.0/libnss*.so, so we should be safe.

Still, other apps will be using an old, unsafe NSS. Only Pidgin depends on this package. We should probably upload a fixed version to squeeze-backports: #6497.


Related issues

Blocks Tails - Feature #6497: Fix various NSS security issues in squeeze-backports Resolved 12/16/2013

History

#1 Updated by intrigeri almost 6 years ago

  • Status changed from Confirmed to In Progress
  • % Done changed from 0 to 20
  • Feature Branch set to feature/torbrowser-24.2.0esr-1+tails1

#2 Updated by intrigeri almost 6 years ago

  • % Done changed from 20 to 50

#3 Updated by intrigeri almost 6 years ago

  • Assignee changed from intrigeri to bertagaz
  • QA Check set to Ready for QA

#4 Updated by bertagaz almost 6 years ago

  • Due date set to 12/29/2013

#5 Updated by bertagaz almost 6 years ago

  • Status changed from In Progress to Fix committed
  • Assignee deleted (bertagaz)
  • % Done changed from 50 to 90
  • QA Check changed from Ready for QA to Pass

#6 Updated by bertagaz almost 6 years ago

  • % Done changed from 90 to 100

#7 Updated by intrigeri over 5 years ago

  • Status changed from Fix committed to Resolved

Also available in: Atom PDF