Differences between revisions 101 and 102
Revision 101 as of 2019-12-17 12:27:45
Size: 79821
Editor: leela52452
Comment: https on http://www.mozilla.org/security/*
Revision 102 as of 2022-12-15 23:36:52
Size: 79843
Editor: GuillemJover
Comment: Clarify OpenPGP term usage
Deletions are marked like this. Additions are marked like this.
Line 57: Line 57:
You are now ready to send OpenPGP (GPG) emails to any recipient via Icedove and to automatically enable encryption for the chosen recipient in the rule you just created. You are now ready to send [[OpenPGP]] signed and/or encrypted emails to any recipient via Icedove and to automatically enable encryption for the chosen recipient in the rule you just created.

Translation(s): English - Deutsch


Icedove is the Thunderbird email client rebranded by Debian.

From DebianEtch through DebianJessie (9th June 2016), Mozilla Thunderbird was not available in Debian with the official name or branding. Instead, a free-software version rebranded by Debian, named Icedove was provided. Starting in DebianStretch, the icedove package is now a transitional package for thunderbird. Normal Debian support policies, including patches for bug fixes, apply to the package.

Contents

  1. Tips
    1. Display Email User Agent
    2. External Editor for Writing Mails
    3. Setting up OpenPGP Encryption
    4. OpenPGP Rules
    5. Icedove seems impossible to send mails via STARTLS after installation of libnss 3.14-1
    6. Shortcuts
    7. Create Own Mail Headers
    8. Selecting URL in Icedove Causes New Page Open In Iceweasel To Take Focus
    9. Problems with Indexing of mails/news
    10. Icedove and the Mozilla Lightning Extension
    11. Open Address Book only
    12. Iceowl-extension does not remember credentials
  2. The future of Icedove
  3. Reporting Bugs
  4. Debugging
    1. Preparation
    2. Starting Debugging
    3. Debugging of file system activity
    4. Debugging Icedove Activity
  5. Backports
    1. l10n for iceowl-extension
  6. Known Packaging Problems
  7. More useful informations
    1. Talks about Icedove
    2. Development
      1. Upstream Resources
      2. Preparation and Requirements
      3. Cloning and Updating the Repository
      4. Patching the upstream sources
        1. 1. Import the patch queue
        2. 2. Modify the source as you wanted, for example improve something on the sources of Icedove/Thunderbird
        3. 3. Commit your changes with the '-s' option, please fill in a useful commit message!
        4. 4. Export the patch queue
        5. 5. Commit the new patch to the Icedove packaging repository
        6. 6. Extract your last changes and mail them to the maintainers
      5. Building own Packages
        1. Building own Packages other the HEAD
  8. Whats New on Icedove?
    1. Icedove 45.1.0
    2. Icedove 45.0
    3. Icedove 38.0.1 - 38.8.0
    4. Icedove 38.7.0, 38.7.2
    5. Icedove 38.6.0
    6. Icedove 38.5.0
    7. Icedove 38.4.0
    8. Icedove 38.3.0
    9. Icedove 38.2.0
    10. Icedove 38.1.0
    11. Icedove 38.0.1
    12. Icedove 31.0 - 31.7
    13. Icedove 31.8.0
    14. Icedove 31.7.0
    15. Icedove 31.6.0
    16. Icedove 31.5.0
    17. Icedove 31.4.0
    18. Icedove 31.3.0
    19. Icedove 31.2.0
    20. Icedove 31.1.2
    21. Icedove 31.1.1
    22. Icedove 31.1.0
    23. Icedove 31.0

Tips

Display Email User Agent

  • Access the "Config Editor" from Edit->Preferences->Advanced (click "I'll be careful...")

  • Search after mailnews.headers.showUserAgent and double click on it to activate it
  • Restart Icedove and notice that, when viewing a message, below the "To" field the "User agent" is present now

External Editor for Writing Mails

  • If you want to use an external editor for composing your message take a look at globs.org

Setting up OpenPGP Encryption

Install the Enigmail extension, restart Icedove and run the OpenPGP Setup Wizard

  1. Install Enigmail via

apt-get install enigmail 

  1. Restart Icedove
  2. Navigate to the new top-menu entry OpenPGP → Setup Wizard
  3. Select Yes and hit Next
  4. Choose whether you want to setup OpenPGP for all identities or just for select identities, if you’ve created more than one identity in Icedove. If you have multiple identities, choosing to setup OpenPGP for all identities will use one key for all of them.
  5. Choose whether you want to sign all of your outgoing emails. Signing does not encrypt emails—it places your digital signature on all of your outgoing emails to allow others to verify that you sent the email. It is recommended not to sign all of your outgoing emails as it strongly links you to everything you send out via unencrypted email directly to yourself. It’s best just to encrypt your emails to everyone you know who supports encryption.
  6. Choose whether you want to encrypt all of your outgoing emails by default. This is not recommended as it is cumbersome if your recipient doesn’t support encryption. You can setup encryption rules later on, which will enable you to always send encrypted emails under conditions you determine.
  7. Choose to make some changes recommended by OpenPGP. These are all technical configuration changes in Icedove that streamline the OpenPGP process and avoid configurations that cause breakages. These are all safe changes, though they do change functionality in some cases, most notably by disabling composing HTML messages.
  8. Either create a key if you haven’t done so already, or select an existing key to use. If you have multiple keys and/or multiple identities, you may have to make some manual changes later to associate the right key with the right identity.
  9. Review the proposed changes and hit Next

If there are no errors, OpenPGP is ready to use. Hit Finish.

OpenPGP Rules

Setup OpenPGP Rules

In Icedove, the Enigmail extension provides the ability for you to setup rules which Icedove will use to automate who will or will not receive encrypted emails from you.

The rule system is pretty powerful and can create a wide array of possible options. This guide will create a rule to always send encrypted email to a specific email address (or multiple email addresses) and operates under the assumption that your emails are unencrypted by default. However, the rule system appears to be powerful enough that if the majority of your contacts use OpenPGP encryption, you can encrypt by default and create a rule that sends unencrypted emails to contacts you have that don’t support encryption.

  1. Navigate to OpenPGP → Edit Per-Recipient Rules
  2. Click the Add button on the upper right.
  3. Enter the email address(es) at the top, separated by spaces if matching multiple email addresses, and is exactly if matching exact addresses or enter matching terms and choose the appropriate matching method. The available matching methods are: is exactly, Contains, Starts with, and Ends with
  4. Choose the Action to be applied upon matching the rule. For this example, choose Use the following OpenPGP keys: and press the Select Key(s)… button. In the box that pops up from that button, select the OpenPGP key for the person to whom you’re sending email. If you don’t have their public key, press the Download missing keys button, which will search the key servers for the email(s) you entered in the matching box.
  5. Change Encryption in the Defaults for … section to Always and leave Signing and PGP/MIME as Yes, if selected in Message Composition.
  6. Press the OK button when you’ve completed the configuration of the rule.

You are now ready to send OpenPGP signed and/or encrypted emails to any recipient via Icedove and to automatically enable encryption for the chosen recipient in the rule you just created.

Icedove seems impossible to send mails via STARTLS after installation of libnss 3.14-1

  • This problem is not really an Icedove bug (#692886 #692491). With releasing version 3.14-1 of libnss no certificates with a md5 signatures are allowed. It's recommended to check your signatures if you are using md5 based signatures in case of problems. You can do this this

    openssl s_client -connect hostname:587 -starttls < /dev/null | sed -n '/BEGIN/,/END/p' | openssl x509 -text

    Search for "Signature Algorithm". For further information please take a look at https://wiki.mozilla.org/CA:MD5and1024

Shortcuts

Take a look at https://support.mozillamessaging.com/en-US/kb/keyboard-shortcuts

Create Own Mail Headers

With editing (or creating) your own ~/.icedove/user.js file you are able to create own, not already shipped Mail Header entrys. It have to looks like that. The entry '{custom headers}' is a comma-separated list of the custom headers you want to be available. "Sender,X-Y" adds the Sender: and X-Y: headers, for example.

// This is a comment
user_pref("mail.compose.other.header", "{custom headers}");

In detail take a look at the following example. More infos on this on mozillaZine

// my own Icedove settings in $HOME/.icedove/user.js
// add these headers to the list of possible headers
user_pref("mail.compose.other.header", "X-Debbugs-CC,X-Debbugs-No-Ack");

Selecting URL in Icedove Causes New Page Open In Iceweasel To Take Focus

This problem is reported in #496632. When selecting URL in icedove, window focus is stolen by iceweasel when it loads the url. A temporary workaround is to set the browser.tabs.loadDivertedInBackground setting. This substantially changes the behavior of iceweasel, so this may not be acceptable for everyone. To access this setting, enter 'about:config' in the url bar. This brings up a warning page, with a button labeled "I'll be careful, I promise!". Scroll to the entry titled "browser.tabs.loadDivertedInBackground". Double clicking on this line toggles the setting. Setting this to "true" will prevent iceweasel from stealing focus in the described case. The instructions for changing this setting were originally found at http://www.techsupportalert.com/content/how-stop-firefox-stealing-window-focus.htm

Problems with Indexing of mails/news

In rare cases it may happen that Icedove is permanently keeps indexing of your mails and messages. The reason for this behavior is mostly a broken or damaged SQLite database. This issue will be easy to fix, you have to delete the broken database. Icedove is creating a new database if not present.

  1. Close the Icedove application
  2. Remove the file $HOME/.icedove/[Your_Profile]/global-messages-db.sqlite

  3. Restart Icedove

Icedove and the Mozilla Lightning Extension

The Lightning extension from Mozilla isn't usable with Icedove >= version 24! This happen because of different internally lifetime linking inside the extension. So please use the iceowl-extension from the Debian repositories.

Open Address Book only

Create a launcher with the following command

 icedove -addressbook 

Iceowl-extension does not remember credentials

Mozilla has changed the way to trust certificates after Firefox or Thunderbird 31. Especially self-signed certificates are not trusted by default any longer (#751086). You can change this behavior by modifying the prefs.js directly or using the UI "Edit -> Preferences -> Advanced -> Tab:General -> Config Editor" and change the following key to 'false'.

 security.use_mozillapkix_verification = false 


The future of Icedove

What is the future of the upstream Thunderbird project and consequently the Icedove package(s) in Debian?

Mozilla has changed their approach to developing and managing Thunderbird. A very public announcement was made about this on 8 July 2012. Since this announcement Mozilla decided to change the focus of their own contributions to the project and will put more emphasis on their web projects and of course on FirefoxOS. Mozilla plans to open the Thunderbird development to a more community driven project but will also be there for security and stability maintenance. There are no plans to close the packaging of Icedove from the Debian side. There is a project webpage from the developer Bejamin Smedbergs which shows the activity from the Mozilla project members. See also the Mozilla TB ESR Release Plan and on the Rapid Release Calendar. As long as Mozilla will provide ESR versions there will be packaged versions of those inside the various release of Debian. The current stable release Debian Wheezy is getting Icedove 17 versions as security updates from the Thunderbird 17 ESR releases. This happen because the Thunderbird 10 ESR circle is marked as end of life and no more security updated will be provided by Mozilla. After the Thunderbird 17 ESR cycle version 24 will be the next ESR release by Mozilla. If possible version 24 will replace version 17 in stable.

It is important to look at this situation in perspective:

  • Even though Thunderbird receives less attention from Mozilla than before July 2012, the long term support is still significantly stronger than the support for many other open source projects. There are several examples of popular open source projects that have been completely abandoned by upstream but lived on nonetheless, procmail is one such example.

  • The Mozilla announcement doesn't mean that any features will go away, it just means new ones may not be added so quickly. Users and potential users should make any decision about their use of Thunderbird/Icedove based on merit alone, e.g. comparing the features available now against the features in similar packages.

Reporting Bugs

Sometimes Icedove is not doing things as expected or some error happen. Then you need help or want to report the issue. Before you do this please visit the web pages Bugs in icedove, calendar-google-provider, calendar-timezones, icedove-dbg, icedove-dev, iceowl-extension and/or icedove-l10n-* and check if you find a solution for your problem or some other bug is closed to yours reported. Please do this careful! Because errors reported twice or more take a lot of time to coordinate!

Your problem isn't there or you want to provide extra information to an already opened bug? You can report it best with reportbug, really! :-) But you can also use an EMail client to send bug reports. To do this please visit Bugs and Reporting.

Before you send your report, please check if you can append some useful information for the developer! Please read the following chapter for this. If you use a version from testing or unstable/experimental please check also if a similar problem is reported to the Bugzilla on Mozilla and provide the URL to that bug entry if possible. This helps the developer (and the reporter too) to get automatic notifications if the status of the upstream bug has changed. If you are an advanced user and you can't find the bug in the database on Mozilla you can create there your new bug report and then open a bug report on the Debian with the upstream URL to this bug. This helps the package maintainers too.

And if you are an expert and can help to scaling down the bug list any help is appreciated! If you can provide some patches to improve Icedove or some other package please don't hesitate to write a mail to the packages maintainer!


Debugging

Sometimes you need some debug information for tracking down problems, for example to give the maintainer more useful information if you have some trouble with Icedove. To get a digestible output with gdb while debugging the application (Icedove and used libraries) must have so named "debugging symbols". For the normal use this symbols inside the application are not necessary. To track file actions there is the possibility to use strace to monitor this.

Preparation

There some dependencies to get a proper debug output. May be you need to install some additional packages. Once the applications with the debugging symbols and the tools to get the output while debugging. Both are necessary. You will need to install the following packages.

additional packages

gdb icedove-dbg strace

Starting Debugging

If these packages are installed you have to start Icedove from a terminal. This is quite simple, you have to give an argument -g to the starting wrapper script of Icedove if the version is <= v10.0.x (like Wheezy or Squeeze). If you use a version of Icedove if > 10.0.x (like stable-security, testing or above) the debugging call has changed. This should be true for all Wheezy installations with security update support (this the default setting while installation). The debugging must be called by the wrapper script /usr/lib/icedove/run-mozilla.sh with option g or debug and the Icedove binary /usr/lib/icedove/icedove-bin. If Icedove is crashing down please also append -safe-mode to prevent the usage of any extension or themes inside Icedove.

   1 # use this if you are running a plain Wheezy without security support (oldstable)
   2 user@pc:~ $ LANG= icedove -g [-safe-mode] 2>&1 | tee /tmp/icedove-gdb-$(dpkg-query -s icedove | grep Version | cut -f3 -d":")_$(date +%F_%T).log 

   1 # use this if you are running stable-security, testing or greater
   2 user@pc:~ $ LANG= /usr/lib/icedove/run-mozilla.sh -g /usr/lib/icedove/icedove-bin --safe-mode 2>&1 | tee /tmp/icedove-gdb-$(dpkg-query -s icedove | grep Version | cut -f3 -d":")_$(date +%F_%T).log 

This starts the gdb with Icedove as program to debug and logs all the output to /tmp/icedove-gdb-[version]_[timestamp].log. The file can be sent to a bug report as attachment (consider about packing this file it before!). This is mostly needed if your Icedove is crashing at some action. Please check the output of the gdb! If you see something like no debugging symbols found check the packages you have installed. With no debugging symbols it's worthless to go further! The next steps are telling gdb to avoid stopping at certain signals with the "handle" command, then to start the Icedove inside the gdb with the "run" command.

   1 (gdb) handle SIGPIPE nostop
   2 Signal        Stop      Print   Pass to program Description
   3 SIGPIPE       No        Yes     Yes             Broken pipe
   4 (gdb) handle SIG38 nostop
   5 Signal        Stop      Print   Pass to program Description
   6 SIG38         No        Yes     Yes             Real-time event 38
   7 (gdb) run

The start of Icedove is taking a little time, after a few seconds you will see (hopefully) the normal GUI screen of Icedove. In the terminal there must be some information to see, in normal case the starting and terminating of Threads, this should looks like this.

   1 user@pc:~ $ # !!! use one of the above described command lines !!!
   2 /usr/lib/icedove/run-mozilla.sh -g /usr/lib/icedove/icedove-bin
   3 MOZILLA_FIVE_HOME=/usr/lib/icedove
   4   LD_LIBRARY_PATH=/usr/lib/icedove:/usr/lib/icedove/plugins:/usr/lib/icedove
   5 DISPLAY=:0
   6 DYLD_LIBRARY_PATH=/usr/lib/icedove:/usr/lib/icedove
   7      LIBRARY_PATH=
   8        SHLIB_PATH=/usr/lib/icedove:/usr/lib/icedove
   9           LIBPATH=/usr/lib/icedove:/usr/lib/icedove
  10        ADDON_PATH=
  11       MOZ_PROGRAM=/usr/lib/icedove/icedove-bin
  12       MOZ_TOOLKIT=
  13         moz_debug=1
  14      moz_debugger=
  15 moz_debugger_args=
  16 /usr/bin/gdb  --args /usr/lib/icedove/icedove-bin
  17 GNU gdb (GDB) 7.4.1-debian
  18 Copyright (C) 2012 Free Software Foundation, Inc.
  19 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
  20 This is free software: you are free to change and redistribute it.
  21 There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
  22 and "show warranty" for details.
  23 This GDB was configured as "x86_64-linux-gnu".
  24 For bug reporting instructions, please see:
  25 <http://www.gnu.org/software/gdb/bugs/>...
  26 Reading symbols from /usr/lib/icedove/icedove-bin...Reading symbols from /usr/lib/debug/usr/lib/icedove/icedove-bin...done.
  27 done.
  28 (gdb) run
  29 Starting program: /usr/lib/icedove/icedove-bin 
  30 [Thread debugging using libthread_db enabled]
  31 Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
  32 [New Thread 0x7fffe5993700 (LWP 9761)]
  33 [New Thread 0x7fffe4ad0700 (LWP 9762)]
  34 [New Thread 0x7fffe42cf700 (LWP 9763)]
  35 [New Thread 0x7fffe36ff700 (LWP 9764)]
  36 [New Thread 0x7fffe23ff700 (LWP 9765)]
  37 [New Thread 0x7fffe1bfe700 (LWP 9766)]
  38 [New Thread 0x7fffe03f6700 (LWP 9767)]
  39 [New Thread 0x7fffdf7ff700 (LWP 9768)]
  40 [New Thread 0x7fffdeffe700 (LWP 9769)]
  41 [New Thread 0x7fffddfff700 (LWP 9770)]
  42 [New Thread 0x7fffdc0ff700 (LWP 9771)]
  43 [Thread 0x7fffe03f6700 (LWP 9767) exited]
  44 [Thread 0x7fffdeffe700 (LWP 9769) exited]

If a crash occurs and Icedove stops working and quits, it's possible to get a backtrace of this. For this run the command bt in the terminal there the gdb runs. Remind that Icedove is programmed as a multi threaded program, because of this we want to see all these threads. For more information about gbd around this take a look on How to get a backtrace.

   1 (gdb) thread apply all bt

This gives out a collection of the last status from the stack. This information is needed if you reporting errors with a crashing Icedove.

Note!

In some special cases a crash of Icedove can produce a crash of your X-Server. If this happen you have to start your Icedove from a screen session. Without this you can't see the output of the backtrace because the terminal is also cleaned up while the X-Server is crashed. After you relogin to your X-Sessions restart your terminal and reattach the screen session with screen -r.

Debugging of file system activity

It is also possible to see what Icedove is trying do on the file system. For this you can use the tool strace. For this Icedove must also started from a terminal. strace logs every system call Icedove makes, and this is a lot! So it is useful to log directly to a file. Note that the file will growing very fast! Best practice is to write the file to the /tmp folder. The file will be dropped if you turn off your PC.

   1 user@pc:~ $ strace -e file -f -s2048 -o /tmp/icedove_dbg.txt icedove

Debugging Icedove Activity

The activity of Icedove itself can also be logged. For this you have to tell Icedove what component(s) with which level (1 to 5, but just use always 5!) into which file you are want to log. This can be done from the CLI (Command Line Interface -> the console) or via extra start script nor extra setting. Possible components are the MCD (MissionControlDesktop), SMTP or IMAP. If you want to log just all components you can use the word 'all' for all the components.

For example to log the Imap activity with level 5 to ~/icedove-activity.log from the console do this

   1 user@pc:~ $ NSPR_LOG_MODULES=IMAP:5 NSPR_LOG_FILE=~/icedove-activity.log icedove
   2 user@pc:~ $ # or IMAP and SMTP together
   3 user@pc:~ $NSPR_LOG_MODULES=IMAP:5,SMTP:5 NSPR_LOG_FILE=~/icedove-activity.log icedove

Attention! The log file can be growing fast and getting big. If you want to send this file to a bug report don't forget it to pack!

You can also put you requirements to an extra file and export/unexport the variables. You may want to do this

   1 # icedove-dbg.sh
   2 # just execute this script to setup this variables
   3 # options for NSPR_LOG_MODULES are
   4 # MCD, SMTP, IMAP or just 'all'
   5 
   6 export NSPR_LOG_MODULES=IMAP:5,SMTP:5
   7 # if you want all components use this
   8 #export NSPR_LOG_MODULES=all:5
   9 export NSPR_LOG_FILE=~/icedove-dbg.txt


Backports

We currently don't create Backport versions for the various release platforms Wheezy and Jessie. There is an agreement with the Release-Team to create and upload security updates instead for Icedove and related packages if there is a new version hitting the ESR release circle. So please ensure you have added the repository for security updates shown on https://www.debian.org/security/ for Jessie and with additions for Wheezy, you will get the recent version automatically. If you unsure how to modify the sources.list use the selector on mozilla.debian.net.

Squeeze users please update to the Jessie release!

l10n for iceowl-extension

If you using the iceowl-extension extension within a Wheezy installation you won't getting the respective l10n package versions via the release or security updates as there was never a package version for iceowl-l10n in the Wheezy release. So if you want to use the calendar in Icedove (aka iceowl-extension) with your locales in your native language please install the needed language pack by selecting on iceowl-l10n Sourcefiles for Jessie.


Known Packaging Problems

There are some problems that needs a lot of time to work on or some rethinking.

  • migration, transition of $HOME/.mozilla-thunderbird to $HOME/.icedove or $HOME/.mozilla/thunderbird and /etc/thunderbird to /etc/icedove
  • restructuring dependencies for locales of icedove (l10n)
  • remove the Debian Branding, we can use the official naming and logos (816679#)


More useful informations

Talks about Icedove

Development

Upstream Resources

There is (unfortunately) no simple way to get related informations from Mozilla for development related things. Mozilla is providing various resources for informations.


Preparation and Requirements

The sources of Icedove Debian package are within a git repo on git.debian.org. They're maintained using git-buildpackage. If you want to help or take a look inside you need to install some tools:

additional packages

git gitk git-buildpackage git-pbuilder devscripts git-email

Icedove has made the switch to debhelper with version 31, so all Icedove builds are now done with debhelper. To be able to build a personal Icedove package you need to setup a build environment, the maintainers doing there testing and final builds with gbp-buildpackage and git-pbuilder.

Cloning and Updating the Repository

Icedove is one of the bigger packages with a lot of source code which have to be prepared to be buildable on every platform. Mostly with every major update on the Mozilla Thunderbird package the build for almost all platforms breaks. Any help to fix any build problems are much appreciated! Also any help to fight lintian issues! If you want to help please don't hesitate to write a mail to pkg-mozilla-maintainers@lists.alioth.debian.org.

If you've found a fix for a bug you can build a patch that is then applicable with the git am command. Use the following work flow to create such patches.

Be sure you have checked out the current Git tree of Icedove, if not done yet, just use git-buildpackage with the gbp clone command instead of manual git commands. This will make sure the necessary branch tracking is set up.

   1 $ gbp clone git://anonscm.debian.org/pkg-mozilla/icedove.git

If you already have a local clone of the repo just update your clone. Also, use the gbp pull command from git-buildpackage. This ensures that all the needed branches from remote get updated.

   1 $ gbp pull
   2 gbp:info: Branch 'master' is already up to date.
   3 gbp:info: Updating 'upstream'
   4 gbp:info: Branch 'pristine-tar' is already up to date.

Patching the upstream sources

In order to change the current behavior of Icedove you have to make changes to the original (upstream) sources. To make your changes later available for the package maintainers you have to respect some few things. If you don't understand the workflow you can write your questions to the package maintainers, and of course, improve then this article. :) Icedove uses the Debian Source 3.0 (quilt) format. In order to patch the upstream source you need to create a patch in debian/patches/. This is simplest when creating a patch queue. git-buildpackage will do the most of the needed steps. To start verify that your local repo is clean (check with git status) and you are on the 'master' branch. Let's start.

1. Import the patch queue

That imports the debian patch queue from the directory debian/patches on top of the source and switches to the branch patch-queue/master.

   1 user@host:~/gitprojects/icedove [master] $ gbp pq import
   2 gbp:info: Trying to apply patches at 'aa5491b2e4141b0ec1f829c1d6c003650a0000c3'
   3 Switched to branch 'patch-queue/master'
   4 ...
   5 gbp:info: Patches listed in 'debian/patches/series' imported on 'patch-queue/master'
   6 user@host:~/gitprojects/icedove [patch-queue/master] $

2. Modify the source as you wanted, for example improve something on the sources of Icedove/Thunderbird

For example change the file debian/icedove-branding/thunderbird-branding.js to point the News website to http://mozilla.debian.net/.

   1 user@host:~/gitprojects/icedove [patch-queue/master] $ vi debian/icedove-branding/thunderbird-branding.js
   2  ... # make your changes
   3 user@host:~/gitprojects/icedove [patch-queue/master] $ git diff
   4 diff --git a/debian/icedove-branding/thunderbird-branding.js b/debian/icedove-branding/thunderbird-branding.js
   5 index 7caf6b6..39256ad 100644
   6 --- a/debian/icedove-branding/thunderbird-branding.js
   7 +++ b/debian/icedove-branding/thunderbird-branding.js
   8 @@ -8,6 +8,6 @@ pref("mailnews.start_page.welcome_url", "about:");
   9  
  10  // start page override to load after an update
  11  //pref("mailnews.start_page.override_url", "chrome://messenger/content/start.xhtml");
  12 -pref("mailnews.start_page.override_url", "about:");
  13 +pref("mailnews.start_page.override_url", "http://mozilla.debian.net/");
  14  
  15  pref("app.vendorURL", "http://www.mozillamessaging.com/%LOCALE%/thunderbird/");

3. Commit your changes with the '-s' option, please fill in a useful commit message!

That should be easy. But don't forget to add a Gbp-Pq-Topic info, that's needed to classify the patch and make life easier if the patch queue must be reworked in case of working on a new major release. In most of the cases some patches doesn't apply then anymore and can be dropped or have to reworked, the Gbp-PqTopic helps then to decide if the patch will be needed any longer. Proper Gbp-Topic's will you find in form of the directory names in debian/patches/.

   1 user@host:~/gitprojects/icedove [patch-queue/master] $ tree -d debian/patches/
   2 debian/patches/
   3 ├── debian-hacks
   4 ├── fixes
   5 ├── icedove
   6 ├── iceowl
   7 ├── porting
   8 ├── prefs
   9 └── system-libs

Use one of these names to mark your patch in the Gbp-Pq-Topic, just add a line into your commit message with the correct topic. See the next shell output to know how.

   1 user@host:~/gitprojects/icedove [patch-queue/master] $ git commit -s debian/icedove-branding/thunderbird-branding.js
   2 ...
   3   1 thunderbird-branding.js: change the mailnews URI to mozilla.net
   4   2 
   5   3 Gbp-Pq-Topic: icedove   <--- adding a patch queue topic
   6   4 
   7   5 Signed-off-by: Peter Petersen <p.petersen@mailprovider.com>
   8   6
   9   7 # Please enter the commit message for your changes. Lines starting
  10   8 # with '#' will be ignored, and an empty message aborts the commit.
  11   9 # Explicit paths specified without -i nor -o; assuming --only paths...
  12  10 # On branch patch-queue/master
  13  11 # Changes to be committed:
  14  12 #   (use "git reset HEAD <file>..." to unstage)
  15  13 #
  16  14 #   modified:   debian/icedove-branding/thunderbird-branding.js
  17 

4. Export the patch queue

To do this just use gbp pq export from git-buildpackage. That exports the debian specific patches into a quilt patch series and change back to the master branch.

   1 user@host:~/gitprojects/icedove [patch-queue/master] $ gbp pq export
   2 gbp:info: On 'patch-queue/master', switching to 'master'
   3 Switched to branch 'master'
   4 gbp:info: Regenerating patch queue in 'debian/patches/'.
   5 # On branch master
   6 # Changes not staged for commit:
   7 #   (use "git add <file>..." to update what will be committed)
   8 #   (use "git checkout -- <file>..." to discard changes in working directory)
   9 #
  10 #       modified:   debian/patches/debian-hacks/Add-another-preferences-directory-for-applications-p.patch
  11 ... # you will see more of modified files, this is a know error in git-buildpackage !!! Read further!
  12 #       modified:   debian/patches/system-libs/Allow-to-build-against-system-libffi.patch
  13 #
  14 # Untracked files:
  15 #   (use "git add <file>..." to include in what will be committed)
  16 #
  17 #       debian/patches/thunderbird-branding.js-change-the-mailnews-URI-to-m.patch
  18 no changes added to commit (use "git add" and/or "git commit -a")

After this git-buildpackage has put the new generated patches into the directory debian/patches/.

5. Commit the new patch to the Icedove packaging repository

The next step is now to commit this patch (and only this patch!) but also the file series (debian/patches/series) to git.

If you work with Wheezy

Please please ignore the other modified patches, don't commit thees changes! The other noise comes from a known issue of git-buildpackage and is fixed in Jessie and above. You can install git-buildpackage from Testing to fix this problem.

   1 user@host:~/gitprojects/icedove [patch-queue/master] $ git add debian/patches/thunderbird-branding.js-change-the-mailnews-URI-to-m.patch
   2 user@host:~/gitprojects/icedove [patch-queue/master] $ git commit debian/patches/thunderbird-branding.js-change-the-mailnews-URI-to-m.patch debian/patches/series
   3 ...
   4   1 changing the News URI from 'about' to 'http://mozilla.debian.net'
   5   2 
   6   3 Signed-off-by: Peter Petersen <p.petersen@mailprovider.com>
   7   4 
   8   5 # Please enter the commit message for your changes. Lines starting
   9   6 # with '#' will be ignored, and an empty message aborts the commit.
  10   7 # On branch master
  11   8 # Your branch is ahead of 'origin/master' by 1 commit.
  12   9 #
  13  10 # Changes to be committed:
  14  11 #   (use "git reset HEAD^1 <file>..." to unstage)
  15  12 #
  16  13 #   new file:   debian/patches/thunderbird-branding.js-change-the-mailnews-URI-to-m.patch
  17  14 #
  18  15 # Changes not staged for commit:
  19  16 #   (use "git add <file>..." to update what will be committed)
  20  17 #   (use "git checkout -- <file>..." to discard changes in working directory)
  21  18 #
  22  19 #   modified:   debian/patches/debian-hacks/Add-another-preferences-directory-for-applications-p.patch
  23  20 #    .... more of modified files
  24 

Now you can clean up all of this modified marked files because we don't want them.

   1 user@host:~/gitprojects/icedove [master] $ git co -f
   2 Your branch is ahead of 'origin/master' by 1 commit.
   3 user@host:~/gitprojects/icedove [master] $ git st
   4 # On branch master
   5 # Your branch is ahead of 'origin/master' by 1 commit.
   6 #
   7 nothing to commit (working directory clean)

6. Extract your last changes and mail them to the maintainers

Just use git-email to provide your patch(es) to pkg-mozilla-maintainers@lists.alioth.debian.org or append your patch to an existing bug.

   1 user@host:~/gitprojects/icedove [master] $ git format-patch HEAD~1
   2 0001-changing-the-News-URI-from-about-to-http-mozilla.deb.patch


Building own Packages

After some modifying the build environment or the sources itself you have to build your own package of Icedove to check if the changes you have made are just fine. To do this ensure you have already set up, or have updated your build environment.

To build your own version is very easy with git-buildpackage. It will checks most of the needed things to let you successful build your own package version. After you have made some changes in the way described above your next step will be to update the debian/changelog file so git-buildpackage can hand over a correct version the building tool (pbuilder, cowbuilder, ...). Please use the command gbp dch to do this. This will create a correct formated new entry to debian/changelog.

   1 gbp dch -a -S    # -a means 'automatic' and -S means 'Snapshot'
   2 

After this you have to commit the changed debian/changelog file because git-buildpackage is normaly unhappy with uncommitted files.

   1 git commit debian/changelog -m "made my own test version"

Next you can start you build.

   1 gbp buildpackage --git-pbuilder --git-pristine-tar

That's it, after some time and two coffees later you will hopefully see your own created Icedove package.

Building own Packages other the HEAD

You can rebuild every tagged Debian version of Icedove. To do this you have to checkout the tagged version into a new local branch, for example if you want to rebuild or modify the tag debian/3.0.11-1+squeeze15 let git this checkout into a local branch mine-3.0.11-1+squeeze15:

   1 git checkout -b mine-3.0.11-1+squeeze15 debian/3.0.11-1+squeeze15

If you want to change something like the source itself do it like described above. If you just want to modify something like compiler options you just have to commit your changes you made into the git tree. For example:

   1 vi debian/rules    # modify some variables
   2 git commit debian/rules

If you are ready with your changes don't forget to change the file debian/changelog too! Remember, gbp dch -a -S will do this for you. If you want to change the version in the changelog file please consider that the version must be greater than the previous version in the changelog file, normally there is nothing to be done by you. Finally you have to commit your changes to the changelog file like described above because git-buildpackage read out the version that the deb package will become.

The call of git-buildpackage differs a little bit because you are not on a Debian branch anymore. The old version 3.0.11-squeeze15 in this example is used in Squeeze stable, so at minimum you have to tell it git-buildpackage. Also the platform you are using, for example amd64. To build your changed version the call of git-buildpackage have to look like:

   1 gbp buildpackage --git-pbuilder --git-pristine-tar --git-ignore-branch  --git-arch=amd64 --git-dist=squeeze

Whats New on Icedove?

What's changed inside the buildsystem or on the debian specific part? Take a look into the Changelog!


Icedove 45.1.0

http://www.mozilla.org/en-US/thunderbird/45.1.0/releasenotes/

New Features, Changes, Fixes
  • Fixed
    • Drag & Drop a contact name from Thunderbird address book (list view) to address box in a new message “compose” window failed.

    • UI elements became larger when moused over on retina displays/monitor on Mac OS X
    • Automatic correspondents column upgrade disabled
    • DIGEST-MD5 authentication in JS-XMPP failed for some users (now disabled).
    • Font indicator in compose falsely claimed certain fonts were not installed.
    • Printing failed in composition window.
    • Various improvements in handling of message compose in paragraph mode.
  • Known Issues
    • Email with signature and safe HTML elements is sent as HTML, despite "Delivery Format: Auto-detect" option

Securityfixes

MFSA 2016-39

Miscellaneous memory safety hazards (rv:46.0 / rv:45.1 / rv:38.8)


Icedove 45.0

http://www.mozilla.org/en-US/thunderbird/45.0/releasenotes/ https://support.mozilla.org/en-US/kb/new-thunderbird-45

New Features, Changes, Fixes
  • New
    • Add a Correspondents column combining Sender and Recipient
    • Improved options for remote content exceptions (but previous settings based on the sender's email address are not migrated, so these need to be added again by users).
    • Allow copying of name and email address from the message header of an email
    • Much better support for XMPP chatrooms and commands.
    • Implement option to always use HTML formatting to prevent unexpected format loss when converting messages to plain text.
    • Use ?OpenStreetmap for maps (even allow the user to choose from list of map services)

    • Allow spell checking and dictionary selection in the subject line
    • Allow editing of From when composing a message.
    • Add dropdown in compose to allow specific setting of font size.
    • Return/Enter in composer will now insert a new paragraph by default (shift-Enter will insert a line break)
    • Mail.ru supports OAuth authentication.
  • Fixed
    • When sending e-mail which was composed using Chinese, Japanese or Korean characters, unwanted extra spaces were inserted within the text.
    • XMPP had connection problems for users with large rosters
    • Spell checker checked spelling in invisible HTML parts of the message.
    • When saving a draft that is edited as new message, original draft was overwritten.
    • External images not displayed in reply/forward
    • Crashed in some cases while parsing IMAP messages.
    • Properly preserve pre-formatted blocks in message replies.
    • Copy/paste from a plain text editor lost white-space (multiple spaces/blanks, tabs, newlines)
    • "Open Draft"/"Forward"/"Edit As New"/"Reply" created message composition with incorrect character encoding.
    • Grouped By view sort direction change was broken, plus enabled custom column grouping.
    • New emails into a mailbox did not adhere to sort order by received.
    • Box.com attachments failed to upload.
    • Drag and drop of multiple attachments failed to OS file folder.
  • Known Issues
    • Outlook and Eudora import non-functional.

Securityfixes

MFSA 2016-37

Font vulnerabilities in the Graphite 2 library

MFSA 2016-36

Use-after-free during processing of DER encoded keys in NSS

MFSA 2016-35

Buffer overflow during ASN.1 decoding in NSS

MFSA 2016-34

Out-of-bounds read in HTML parser following a failed allocation

MFSA 2016-27

Use-after-free during XML transformations

MFSA 2016-24

Use-after-free in SetBody

MFSA 2016-23

Use-after-free in HTML5 string parser

MFSA 2016-20

Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-19

Linux video memory DOS with Intel drivers

MFSA 2016-18

CSP reports fail to strip location information for embedded iframe pages

MFSA 2016-17

Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-16

Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)


Icedove 38.0.1 - 38.8.0

Icedove 38.7.0, 38.7.2

http://www.mozilla.org/en-US/thunderbird/38.7.0/releasenotes/

New Features, Changes, Fixes
  • No new Features there added

Securityfixes

MFSA 2016-37

Font vulnerabilities in the Graphite 2 library

MFSA 2016-35

Buffer overflow during ASN.1 decoding in NSS

MFSA 2016-34

Out-of-bounds read in HTML parser following a failed allocation

MFSA 2016-31

Memory corruption with malicious NPAPI plugin

MFSA 2016-27

Use-after-free during XML transformations

MFSA 2016-24

Use-after-free in SetBody

MFSA 2016-23

Use-after-free in HTML5 string parser

MFSA 2016-20

Memory leak in libstagefright when deleting an array during MP4 processing

MFSA 2016-17

Local file overwriting and potential privilege escalation through CSP reports

MFSA 2016-16

Miscellaneous memory safety hazards (rv:45.0 / rv:38.7)


Icedove 38.6.0

http://www.mozilla.org/en-US/thunderbird/38.6.0/releasenotes/

New Features, Changes, Fixes
  • Fixes
    • Filters ran on a different folder than selected

Securityfixes

MFSA 2016-14

Vulnerabilities in Graphite 2

MFSA 2016-03

Buffer overflow in WebGL after out of memory allocation

MFSA 2016-01

Miscellaneous memory safety hazards (rv:44.0 / rv:38.6)

MFSA 2015-150

MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature


Icedove 38.5.0

http://www.mozilla.org/en-US/thunderbird/38.5.0/releasenotes/

New Features, Changes, Fixes
  • Fixes
    • In the address book manager, make the contacts sidebar remember the last selected address book (MozBug1142705)

Securityfixes

MFSA 2015-149

Cross-site reading attack through data and view-source URIs

MFSA 2015-146

Integer overflow in MP4 playback in 64-bit versions

MFSA 2015-145

Underflow through code inspection

MFSA 2015-139

Integer overflow allocating extremely large textures

MFSA 2015-134

Miscellaneous memory safety hazards (rv:43.0 / rv:38.5)


Icedove 38.4.0

http://www.mozilla.org/en-US/thunderbird/38.4.0/releasenotes/

New Features, Changes, Fixes
  • Fixes
    • Fixed issue where messages moves of multiple messages from a maildir folder to an mbox folder failed

Securityfixes

MFSA 2015-133

NSS and NSPR memory corruption issues

MFSA 2015-132

Mixed content WebSocket policy bypass through workers

MFSA 2015-131

Vulnerabilities found through code inspection

MFSA 2015-128

Memory corruption in libjar through zip files

MFSA 2015-127

CORS preflight is bypassed when non-standard Content-Type headers are received

MFSA 2015-123

Buffer overflow during image interactions in canvas

MFSA 2015-122

Trailing whitespace in IP address hostnames can bypass same-origin policy

MFSA 2015-116

Miscellaneous memory safety hazards (rv:42.0 / rv:38.4)


Icedove 38.3.0

http://www.mozilla.org/en-US/thunderbird/38.3.0/releasenotes/

New Features, Changes, Fixes
  • News
    • Saved files tab now implements Search field and Clear button
  • Fixes
    • (Right-)Clicking on a newsgroup now allows directly composing a message again (MozBug1180360)

    • Importing to the address book from CSV now works with international characters
    • Thunderbird no longer crashes when executing filter rules when using maildir (MozBug797710)

    • When using the maildir storage format, the INBOX folder is no longer deleted (MozBug1175242)

    • Emails with long References headers are now decoded correctly (MozBug1197686)

    • Checking for new messages correctly works after hibernation again (MozBug1196662)

    • Chat entries are no longer sometimes lost in global database at shutdown (MozBug1146698)

Securityfixes

MFSA 2015-113

Memory safety errors in libGLES in the ANGLE graphics library

MFSA 2015-112

Vulnerabilities found through code inspection

MFSA 2015-111

Errors in the handling of CORS preflight request headers

MFSA 2015-110

Dragging and dropping images exposes final URL after redirects

MFSA 2015-106

Use-after-free while manipulating HTML media content

MFSA 2015-105

Buffer overflow while decoding WebM video

MFSA 2015-101

Buffer overflow in libvpx while parsing vp9 format video

MFSA 2015-100

Arbitrary file manipulation by local user through Mozilla updater

MFSA 2015-96

Miscellaneous memory safety hazards (rv:41.0 / rv:38.3)


Icedove 38.2.0

http://www.mozilla.org/en-US/thunderbird/38.2.0/releasenotes/

New Features, Changes, Fixes
  • Changes
    • Hardware acceleration is now disabled by default to avoid crashing Thunderbird
  • Fixes
    • A few bugs have been fixed to avoid crashing Thunderbird
  • Known Issues
    • The "maildir" storage type can no longer be set through the UI due to various issues. Power users can still set the storage type using the config editor.

Securityfixes

MFSA 2015-90

Vulnerabilities found through code inspection

MFSA 2015-88

Heap overflow in gdk-pixbuf when scaling bitmap images

MFSA 2015-84

Arbitrary file overwriting through Mozilla Maintenance Service with hard links

MFSA 2015-79

Miscellaneous memory safety hazards (rv:40.0 / rv:38.2)


Icedove 38.1.0

http://www.mozilla.org/en-US/thunderbird/38.1.0/releasenotes/

New Features, Changes, Fixes
  • Fixes
    • Copy/Paste into plain text editor deletes newlines from quoted text (MozBug1143570)

    • Cross-posts won't send because Newsgroups: groups are separated with comma+space, not just comma (MozBug1151448)

    • Cannot send email through exchange server (NTLM) (MozBug1174159)

    • Doesn't display GB2312 encoded texts correctly for Chinese Characters (MozBug1174580)

    • OAuth2 authentication for GMail does not work when specified server is imap.gmail.com or smtp.gmail.com (MozBug1176773)

  • Known Issues
    • Import from Outlook and Eudora disabled, code currently not working (MozBug1175055)

Securityfixes

MFSA 2015-71

NSS incorrectly permits skipping of ServerKeyExchange

MFSA 2015-70

NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-67

Key pinning is ignored when overridable errors are encountered

MFSA 2015-66

Vulnerabilities found through code inspection

MFSA 2015-63

Use-after-free in Content Policy due to microtask execution error

MFSA 2015-59

Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)


Icedove 38.0.1

http://www.mozilla.org/en-US/thunderbird/38.0.1/releasenotes/

New Features, Changes, Fixes
  • New
    • GMail supports OAuth2 authentication, removing the need to manually select "allow less secure applications" in Google options for the account. (MozBug849540)

    • Filter sent messages (MozBug11039)

    • Filter messages when archived (MozBug479823)

    • Enable search in multiple/all address books (MozBug170270)

    • Add support for Yahoo Messenger in Chat (MozBug955574)

    • Support Internationalized domain name URLs for RSS feeds (MozBug1018589)

    • Show expanded columns in folder pane (MozBug464973)

    • Allow file-per-message (maildir) local message storage, only for new accounts! (MozBug845952)

    • Add a Learn more link to the support page in feeds subscribe dialog (MozBug1053782)

    • Add reading position marker line to conversations (MozBug760762)

    • The editor for twitter should show inputtable character count (MozBug736002)

  • Changed
    • Thunderbird will no longer use SHA-1 to sign messages (MozBug1018259)

    • Removed rarely used character sets: T.61-8bit, non-encoding Mac encoders, VISCII, x-viet-tcvn5712, x-viet-vps x-johab, ARMSCII8 , map us-ascii to windows-1252, ISO-8859-6-I and -E and ISO-8859-8-E, (MozBug1068505 and others.)

    • Disable CONDSTORE support for IMAP to prevent discrepancies in IMAP message status (deleted, unread) on some servers (MozBug912216)

    • Make OpenSearch queries open in the user's default browser (MozBug1120777)

    • Default to using SSL for XMPP and IRC. This might cause issues for self-signed certificates (MozBug1122567, MozBug1122666)

  • Fixed
    • Replied/forwarded icons disappear after folder repair, detach/delete (MozBug840418)

    • Attachment "Save As" files are displayed in Tools/Saved Files (MozBug914517)

    • Adding unknown email addresses to Mailing list, then deleting ghost duplicate entries from contacts pane, caused data loss in mailing list (MozBug628035)

    • Web site from RSS feed was not rendered correctly (MozBug662907)

    • Email address with leading/trailing whitespace displayed wrongly with added quotes when composing ["foo"@bar.com] (MozBug286760)

    • Force display of Sender header if S/MIME sender is the signer (MozBug332639)

    • Addressing autocomplete widget: Typed text in red despite results/matches found if suggestions change by last input (MozBug1042561)

    • Status bar not accessible (MozBug934875)

    • Wrong folder may be deleted when requesting junk delete (MozBug1018960)

    • Severe UI stutter or freezes getting new mail for very large folders (MozBug870556)

    • Automatically rejoin multi-user conversations on reconnect for XMPP (MozBug1014472)

    • Various improvements when using IRC on moznet (MozBug1083768 and others)

    • Significantly improve XMPP support (MozBug1085022 and others)

    • Fixes for connecting to non-standard IRC networks (MozBug870556 and others)

    • Automatically reclaim IRC nicks during a reconnect (MozBug1087566)

    • Changing location in editor doesn't preserve the font when returning to end of text/line (MozBug756984)

    • Inline spell checker loses red underlines after a backspace is used (MozBug1100966)

  • Known Issues
    • Automatic addon compatibility update checks were not completed, so existing addon compatibilities may not be accurate.
    • Copy/Paste into plain text editor deletes newlines from quoted text (MozBug1143570)

    • Importing data from Outlook or Eudora crashes (MozBug917961)

  • Debian specific
    • Debian isn't using a opt-out dialog for installation of iceowl-extension (the rebranded Lightning AddOn) as we have a tag Recommends for the package managers. If you haven't disabled the automatic installation of recommended packages the package iceowl-extension will be installed automatically. If there is a Lightning package already installed it will be used ongoing but iceowl-extension will be also installed. You can switch to iceowl-extension by deinstalltion of the Lightning AddOn, you wont lose any data.

Securityfixes

MFSA 2015-57

Privilege escalation through IPC channel messages

MFSA 2015-54

Buffer overflow when parsing compressed XML

MFSA 2015-51

Use-after-free during text processing with vertical text enabled

MFSA 2015-48

Buffer overflow with SVG content and CSS

MFSA 2015-47

Buffer overflow parsing H.264 video with Linux Gstreamer

MFSA 2015-46

Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)


Icedove 31.0 - 31.7

Icedove 31.8.0

http://www.mozilla.org/en-US/thunderbird/31.8.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

Securityfixes

MFSA 2015-71

NSS incorrectly permits skipping of ServerKeyExchange

MFSA 2015-70

NSS accepts export-length DHE keys with regular DHE cipher suites

MFSA 2015-66

Vulnerabilities found through code inspection

MFSA 2015-59

Miscellaneous memory safety hazards (rv:39.0 / rv:31.8 / rv:38.1)


Icedove 31.7.0

http://www.mozilla.org/en-US/thunderbird/31.7.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

Securityfixes

MFSA 2015-57

Privilege escalation through IPC channel messages

MFSA 2015-54

Buffer overflow when parsing compressed XML

MFSA 2015-51

Use-after-free during text processing with vertical text enabled

MFSA 2015-48

Buffer overflow with SVG content and CSS

MFSA 2015-47

Buffer overflow parsing H.264 video with Linux Gstreamer

MFSA 2015-46

Miscellaneous memory safety hazards (rv:38.0 / rv:31.7)


Icedove 31.6.0

http://www.mozilla.org/en-US/thunderbird/31.6.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

Securityfixes

MFSA 2015-40

Same-origin bypass through anchor navigation

MFSA 2015-37

CORS requests should not follow 30x redirections after preflight

MFSA 2015-33

resource:// documents can load privileged pages

MFSA 2015-31

Use-after-free when using the Fluendo MP3 GStreamer plugin

MFSA 2015-30

Miscellaneous memory safety hazards (rv:37.0 / rv:31.6)


Icedove 31.5.0

http://www.mozilla.org/en-US/thunderbird/31.5.0/releasenotes/

New Features, Changes, Fixes
  • Changes
    • SSLv3 is now disabled
  • Fixes
    • Fixes an issue where using LDAP autocomplete could end up with blank entries in the compose addressing list (MozBug 1045753)

    • Fixes an issue where IRC participants were not removed from the display on leaving a channel.
    • Fixes a regression where Thunderbird wasn't respecting the skip integration option on the default client dialog.
    • The extension calendar-google-provider is working again also in wheezy-security. See #770008

Securityfixes

MFSA 2015-24

Reading of local files through manipulation of form autocomplete

MFSA 2015-19

Out-of-bounds read and write while rendering SVG content

MFSA 2015-16

Use-after-free in IndexedDB

MFSA 2015-01

Miscellaneous memory safety hazards (rv:36.0 / rv:31.5)


Icedove 31.4.0

http://www.mozilla.org/en-US/thunderbird/31.4.0/releasenotes/

New Features, Changes, Fixes
  • Fixes
    • Installing extensions within Thunderbird no longer requires download and installing as a file (MozBug 1081190)

    • Autocomplete suggestion sort order was adjusted to prioritize entries where the search string matches the beginning of a word (MozBug 970456)

  • Known Issues
    • The extension calendar-google-provider is working again (only sid and Jessie/testing). See #770008

Securityfixes

MFSA 2015-04

Cookie injection through Proxy Authenticate responses

MFSA 2015-03

sendBeacon requests lack an Origin header

MFSA 2015-01

Miscellaneous memory safety hazards (rv:35.0 / rv:31.4)


Icedove 31.3.0

http://www.mozilla.org/en-US/thunderbird/31.3.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

  • Fixes
    • Fixes an issue where using LDAP autocomplete could end up with blank entries in the compose addressing list (MozBug 1045753)

    • Fixes an issue where IRC participants were not removed from the display on leaving a channel.
    • Fixes a regression where Thunderbird wasn't respecting the skip integration option on the default client dialog.
  • Known Issues
    • The extension calendar-google-provider isn't working due API changes by Google. See #770008

Securityfixes

MFSA 2014-89

Bad casting from the BasicThebesLayer to BasicContainerLayer

MFSA 2014-88

Buffer overflow while parsing media content

MFSA 2014-87

Use-after-free during HTML5 parsing

MFSA 2014-85

XMLHttpRequest crashes with some input streams

MFSA 2014-83

Miscellaneous memory safety hazards (rv:34.0 / rv:31.3)


Icedove 31.2.0

http://www.mozilla.org/en-US/thunderbird/31.2.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

  • Fixes
    • Fixed a case where having a contact and card in an address book with the same name could send to the mailing list (MozBug 1008718)

    • Invalid certificate issue with mozilla::pkix (MozBug 1042889)

    • Importing an RSA private key fails if p < q (MozBug 1049435)

Securityfixes

MFSA 2014-81

Inconsistent video sharing within iframe

MFSA 2014-79

Use-after-free interacting with text directionality

MFSA 2014-77

Out-of-bounds write with WebM video

MFSA 2014-76

Web Audio memory corruption issues with custom waveforms

MFSA 2014-75

Buffer overflow during CSS manipulation

MFSA 2014-74

Miscellaneous memory safety hazards (rv:33.0 / rv:31.2)


Icedove 31.1.2

http://www.mozilla.org/en-US/thunderbird/31.1.2/releasenotes/

New Features, Changes, Fixes

No new features there added.

  • Fixes
    • Fixed an issue where anchor links would not work in HTML emails (MozBug 974857)

Securityfixes

MFSA 2014-73

RSA Signature Forgery in NSS


Icedove 31.1.1

http://www.mozilla.org/en-US/thunderbird/31.1.1/releasenotes/

New Features, Changes, Fixes

No new features there added.

  • Fixes
    • Fixed an issue where mailing lists with spaces in their names couldn't be autocompleted (MozBug 1060901)

    • Fixed an occasional startup crash (MozBug 1005336)


Icedove 31.1.0

http://www.mozilla.org/en-US/thunderbird/31.1.0/releasenotes/

New Features, Changes, Fixes

No new features there added.

Securityfixes

MFSA 2014-72

Use-after-free setting text directionality

MFSA 2014-70

Out-of-bounds read in Web Audio audio timeline

MFSA 2014-69

Uninitialized memory use during GIF rendering

MFSA 2014-68

Use-after-free during DOM interactions with SVG

MFSA 2014-67

Miscellaneous memory safety hazards (rv:32.0 / rv:31.1 / rv:24.8)


Icedove 31.0

http://www.mozilla.org/en-US/thunderbird/31.0/releasenotes/

New Features, Changes, Fixes

Securityfixes

MFSA 2014-66

IFRAME sandbox same-origin access through redirect

MFSA 2014-65

Certificate parsing broken by non-standard character encoding

MFSA 2014-64

Crash in Skia library when scaling high quality images

MFSA 2014-63

Use-after-free while when manipulating certificates in the trusted cache

MFSA 2014-62

Exploitable WebGL crash with Cesium JavaScript library

MFSA 2014-61

Use-after-free with FireOnStateChange event

MFSA 2014-59

Use-after-free in DirectWrite font handling

MFSA 2014-58

Use-after-free in Web Audio due to incorrect control message ordering

MFSA 2014-57

Buffer overflow during Web Audio buffering for playback

MFSA 2014-56

Miscellaneous memory safety hazards (rv:31.0 / rv:24.7)


Icedove 17.x - 24.x


CategorySoftware | CategoryNetworkApplication | CategoryNetwork | CategoryLegacy | CategoryRedundant: merge relevant info with Thunderbird