Still no security patched Firefox 3.5.1 in yum?

[marko]

Firefox 3.5 has a critical java script vulnerability as noted in the recent news. I had to manually update to 3.5.1 using the mozilla tarball because there's still no Firefox 3.5.1 in Fedora Updates or even Fedora Updates Testing repositories. Is this normal? I didn't want to resort to using the mozilla one because now I can't use flash (my system is 64 bit and mozilla only seems to offer a 32bit tar file of Firefox) and having two Firefoxs means dealing with the ProfileManager, separate bookmarks and so on.

I'm trying to find out if I'm just looking in the wrong place, I tried the normal mirrors for "updates" for Fedora 11 and then updates-testing and also the baseurl for "updates" to get rid of the mirror update delay. None of them seem to have 3.5.1 ?

Maybe I'm over-reacting and it would sufficient to just turn off jit.content in the about:config of my Firefox 3.5.
I'm also using noscript. I see it was only noted by mozilla org on July 16 so maybe it's just too soon to expect it in yum

http://www.mozilla.org/security/anno...sa2009-41.html

[marko]

Originally Posted by marko

Firefox 3.5 has a critical java script vulnerability as noted in the recent news. I had to manually update to 3.5.1 using the mozilla tarball because there's still no Firefox 3.5.1 in Fedora Updates or even Fedora Updates Testing repositories. Is this normal? I didn't want to resort to using the mozilla one because now I can't use flash (my system is 64 bit and mozilla only seems to offer a 32bit tar file of Firefox) and having two Firefoxs means dealing with the ProfileManager, separate bookmarks and so on.

I'm trying to find out if I'm just looking in the wrong place, I tried the normal mirrors for "updates" for Fedora 11 and then updates-testing and also the baseurl for "updates" to get rid of the mirror update delay. None of them seem to have 3.5.1 ?

Maybe I'm over-reacting and it would sufficient to just turn off jit.content in the about:config of my Firefox 3.5.
I'm also using noscript. I see it was only noted by mozilla org on July 16 so maybe it's just too soon to expect it in yum

http://www.mozilla.org/security/anno...sa2009-41.html

UPDATE
I've set my jit.content to false and will just wait for the eventual update in yum, as I read more about this that sounds sufficient to block the vulnerability.

[nirik]

It's been build for a while, but just hasn't pushed out yet due to slow mirror sync issues

You can get it direct frorm the build system at:
http://koji.fedoraproject.org/koji/b...buildID=114800

just download it from koji using rpm --Uvh