The following reply was made to PR pkg/29595; it has been noted by GNATS.

From: Lubomir Sedlacik <salo@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: PR/29595 CVS commit: [pkgsrc-2005Q1] pkgsrc/www
Date: Mon, 16 May 2005 15:07:14 +0000 (UTC)

 Module Name:	pkgsrc
 Committed By:	salo
 Date:		Mon May 16 15:07:14 UTC 2005
 
 Modified Files:
 	pkgsrc/www/firefox [pkgsrc-2005Q1]: Makefile Makefile-firefox.common
 	    PLIST buildlink3.mk distinfo
 	pkgsrc/www/firefox-gtk1 [pkgsrc-2005Q1]: PLIST buildlink3.mk
 
 Log Message:
 Pullup ticket 504 - requested by Shin'ichiro TAYA
 security update for firefox
 
 Revisions pulled up:
 - pkgsrc/www/firefox/Makefile			1.15
 - pkgsrc/www/firefox/Makefile-firefox.common	1.14, 1.16-1.18
 - pkgsrc/www/firefox/PLIST			1.13-1.15
 - pkgsrc/www/firefox/buildlink3.mk		1.5
 - pkgsrc/www/firefox/distinfo			1.29
 - pkgsrc/www/firefox-gtk1/PLIST			1.3-1.4
 - pkgsrc/www/firefox-gtk1/buildlink3.mk		1.4
 
    Module Name:		pkgsrc
    Committed By:	taya
    Date:		Wed Apr 13 13:34:26 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox: Makefile-firefox.common PLIST
    	pkgsrc/www/firefox-gtk1: PLIST
 
    Log Message:
    change extensions list as same as Linux official build.
    bump PKGREVISION.
    fix PR pkg/29595
 ---
    Module Name:		pkgsrc
    Committed By:	wiz
    Date:		Fri Apr 15 12:42:27 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox: PLIST
 
    Log Message:
    Add two @exec ${MKDIR} lines for empty directories which have @dirrm
    lines, to fix binary packages.
 ---
    Module Name:		pkgsrc
    Committed By:	wiz
    Date:		Fri Apr 15 12:44:30 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox-gtk1: PLIST
 
    Log Message:
    Add an @exec ${MKDIR} line for an empty directory which has a @dirrm
    line, to fix binary packages.
 ---
    Module Name:		pkgsrc
    Committed By:	taya
    Date:		Sun Apr 24 14:00:12 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox: Makefile-firefox.common
 
    Log Message:
    concatinate extensions with separator ',' and set to MOZILLA_EXTENSIONS,
    instead of using ':ts' modifier.
    becase make of NetBSD-1.6.x doesn't have it.
    suggested by Jeremy C. Reed.
 ---
    Module Name:		pkgsrc
    Committed By:	reed
    Date:		Mon Apr 25 19:26:10 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox: Makefile-firefox.common
 
    Log Message:
    Make sure build is without gssapi support. (Okayed by maintainer,
    taya ... well really he said "I don't object your idea.")
 
    This fixes a build bug when heimdal is detected but not buildlinked.
    It is a known mozilla bug:
     https://bugzilla.mozilla.org/show_bug.cgi?id=245467
 
    I didn't put this in the mozilla/Makefile.common, because didn't test
    that yet.
 
    This issue probably only happens when using /usr as the LOCALBASE,
    which is not really supported and maybe I am the only one to hit this
    with pkgsrc.
 
    Maybe later someone can consider adding a build option for GSSAPI,
    but I don't know anything about it in regards to a web browser myself.
 ---
    Module Name:		pkgsrc
    Committed By:	taya
    Date:		Sat May 14 15:27:10 UTC 2005
 
    Modified Files:
    	pkgsrc/www/firefox: Makefile Makefile-firefox.common PLIST
    	    buildlink3.mk distinfo
    	pkgsrc/www/firefox-gtk1: buildlink3.mk
 
    Log Message:
    Update firefox & firefox-gtk1 to 1.0.4.
 
    This is a security fix release.
    Fixed vulnerabilities are follows:
 
    MFSA 2005-44  Privilege escalation via non-DOM property overrides
    MFSA 2005-43 "Wrapped" javascript: urls bypass security checks
    MFSA 2005-42 Code execution via javascript: IconURL
 
 
 To generate a diff of this commit:
 cvs rdiff -r1.12 -r1.12.2.1 pkgsrc/www/firefox/Makefile \
     pkgsrc/www/firefox/PLIST
 cvs rdiff -r1.11.2.3 -r1.11.2.4 pkgsrc/www/firefox/Makefile-firefox.common
 cvs rdiff -r1.2.2.1 -r1.2.2.2 pkgsrc/www/firefox/buildlink3.mk
 cvs rdiff -r1.25.2.3 -r1.25.2.4 pkgsrc/www/firefox/distinfo
 cvs rdiff -r1.2 -r1.2.2.1 pkgsrc/www/firefox-gtk1/PLIST
 cvs rdiff -r1.1.1.1.2.1 -r1.1.1.1.2.2 pkgsrc/www/firefox-gtk1/buildlink3.mk
 
 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.