Note that version 2.25 has been modified to include the Lightening agenda extension.
Otherwise it seems that only the branding has changed, since it uses exactly the same profile directories.

Because of recurrent problems with Seamonkey 2.25 (32b on 64b Mageia), I tried Iceape 2.25 (64b), and found that one of my important extensions (clrtabs) no longer works.
It does work with Seamonkey (64b), but that is not localized, and the language packs only partially localize Seamonkey.

So I strongly suspect that this problem is due to the added Lightening extension.

So could whoever updates Iceape please leave out the Lightening extention ?
The user can always download it from Mozilla if they want to, or it could be packaged separately.

That would be very much appreciated.
Thanks :)

CC: (none) => andre999mga

clrtabs = ColorfulTabs? Could be caused by the branding, I wouldn't expect lightning to do anything. Lightning is still an extension and can be disabled but that doesn't fix ColorfulTabs.

(Right, clrtabs is the internal name.)

Indeed it could be the branding, but without the Lightning extension, it should be easier to debug.
It could be related to the paths used by clrtabs, but all my other extensions worked normally.
(I just used a copy of my usual profile for testing, and iceape asked to reinstall a few of my 10 or so extensions.)

In any case, there is no harm in not including Lightning.  Those who want it can easily download/install it from mozilla via iceape.

Updated packages are ready for testing:

MGA3
Source RPM:
iceape-2.26-1.mga3.src.rpm

Binary RPMS:
iceape-2.26-1.mga3.i586.rpm
iceape-2.26-1.mga3.x86_64.rpm


MGA4
Source RPM:
iceape-2.26-1.mga4.src.rpm

Binary RPMS:
iceape-2.26-1.mga4.i586.rpm
iceape-2.26-1.mga4.x86_64.rpm


Proposed advisory:




Updated iceape packages fix security issues:

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1518)

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. (CVE-2014-1519)

The mozilla::dom::OscillatorNodeEngine::ComputeCustom function in the Web Audio subsystem in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read, memory corruption, and application crash) via crafted content. (CVE-2014-1522)

Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image. (CVE-2014-1523)

The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not properly check whether objects are XBL objects, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted JavaScript code that accesses a non-XBL object as if it were an XBL object. (CVE-2014-1524)

The mozilla::dom::TextTrack::AddCue function in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 does not properly perform garbage collection for Text Track Manager variables, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and heap memory corruption) via a crafted VIDEO element in an HTML document. (CVE-2014-1525)

The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass intended source-component restrictions and execute arbitrary JavaScript code in a privileged context via a crafted web page for which Notification.permission is granted. (CVE-2014-1529)

The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the loading of a URL with a spoofed baseURI property, and conduct cross-site scripting (XSS) attacks, via a crafted web site that performs history navigation. (CVE-2014-1530)

Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving an imgLoader object that is not properly handled during an image-resize operation. (CVE-2014-1531)

Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to host resolution. (CVE-2014-1532)

The XrayWrapper implementation in Mozilla Firefox before 29.0 and SeaMonkey before 2.26 allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site that is visited in the debugger, leading to unwrapping operations and calls to DOM methods on the unwrapped objects. (CVE-2014-1526)




References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1518
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1519
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1522
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1523
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1524
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1525
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1526
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1529
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1530
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1531
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1532
http://www.mozilla.org/security/announce/2014/mfsa2014-34.html
http://www.mozilla.org/security/announce/2014/mfsa2014-36.html
http://www.mozilla.org/security/announce/2014/mfsa2014-37.html
http://www.mozilla.org/security/announce/2014/mfsa2014-38.html
http://www.mozilla.org/security/announce/2014/mfsa2014-39.html
http://www.mozilla.org/security/announce/2014/mfsa2014-42.html
http://www.mozilla.org/security/announce/2014/mfsa2014-43.html
http://www.mozilla.org/security/announce/2014/mfsa2014-44.html
http://www.mozilla.org/security/announce/2014/mfsa2014-46.html
http://www.mozilla.org/security/announce/2014/mfsa2014-47.html

Assignee: cjw => qa-bugs

Tested mga4-64

Browser:
General browsing
Sunspider javascript
Javatester for java plugin
youtube for flash plugin 
Acid3 for general use

Mail:
Send/receive/move/delete over stmp/imap

Chatzilla:
connect to mageia-qa channel on freenode

No regressions noted.

CC: (none) => wrw105
Whiteboard: MGA4TOO, MGA3TOO => MGA4TOO, MGA3TOO mga4-64-ok

tested mga4-32 as in comment 5

No regressions noted, all OK.

Whiteboard: MGA4TOO, MGA3TOO mga4-64-ok => MGA4TOO, MGA3TOO mga4-64-ok mga4-32-ok

Tested mga3-32 as in comment 5

No regressions noted, all OK.

Whiteboard: MGA4TOO, MGA3TOO mga4-64-ok mga4-32-ok => MGA4TOO, MGA3TOO mga4-64-ok mga4-32-ok mga3-32-ok

tested mga3-64 as in comment 5

No regressions noted, all OK.

Ready for validation when advisory is uploaded to svn.

Whiteboard: MGA4TOO, MGA3TOO mga4-64-ok mga4-32-ok mga3-32-ok => MGA4TOO, MGA3TOO mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok

Well done Bill.

Validating. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok => MGA3TOO has_procedure advisory mga4-64-ok mga4-32-ok mga3-32-ok mga3-64-ok
CC: (none) => sysadmin-bugs

Advisory had _way_ too long lines.

Update pushed:
http://advisories.mageia.org/MGASA-2014-0259.html

Status: ASSIGNED => RESOLVED
CC: (none) => tmb
Resolution: (none) => FIXED

oops sorry