iceape - several

Several vulnerabilities have been found in the Iceape internet suite, an
unbranded version of Seamonkey:

• CVE-2011-0083 /
  CVE-2011-2363
  regenrecht discovered two use-after-frees in SVG processing,
  which could lead to the execution of arbitrary code.
• CVE-2011-0085
  regenrecht discovered a use-after-free in XUL processing, which
  could lead to the execution of arbitrary code.
• CVE-2011-2362
  David Chan discovered that cookies were insufficiently isolated.
• CVE-2011-2371
  Chris Rohlf and Yan Ivnitskiy discovered an integer overflow in the
  JavaScript engine, which could lead to the execution of arbitrary
  code.
• CVE-2011-2373
  Martin Barbella discovered a use-after-free in XUL processing,
  which could lead to the execution of arbitrary code.
• CVE-2011-2374
  Bob Clary, Kevin Brosnan, Nils, Gary Kwong, Jesse Ruderman and
  Christian Biesinger discovered memory corruption bugs, which may
  lead to the execution of arbitrary code.
• CVE-2011-2376
  Luke Wagner and Gary Kwong discovered memory corruption bugs, which
  may lead to the execution of arbitrary code.

The oldstable distribution (lenny) is not affected. The iceape
package only provides the XPCOM code.

For the stable distribution (squeeze), this problem has been fixed in
version 2.0.11-6.

For the unstable distribution (sid), this problem has been fixed in
version 2.0.14-3.

We recommend that you upgrade your iceape packages.