Am 28.12.2015 um 22:57 schrieb Bojan Smojver: > Release notes for FF 43.0.2 say that a security issue was fixed (MD5 > signatures accepted within TLS 1.2 ServerKeyExchange in server > signature). Does this not affect Fedora builds? what do you try to tell us with that question? [harry@srv-rhsoft:~]$ rpm -q firefox firefox-43.0-1.fc23.x86_64

Reindl Harald <h.reindl <at> thelounge.net> writes: > what do you try to tell us with that question? I'm trying to establish whether Fedora needs a 43.0.2 (or better) build of FF in order to close this security hole.

Eric Griffith <egriffith92 <at> gmail.com> writes: > Is there any reason Fedora would not...? Regardless you could diff the source code that was used to make the 43.0.1-fedora RPM vs whats in 43.0.2 and see if the hole is unpatched. There may be a reason. Fedora relies on NSS/NSPR packages for some of the stuff that Windows folks get bundled with FF, AFAIK. So, a maintainer of FF would know such things. Comparing source will not necessarily give the correct answer, as that part of it may be unused in Fedora builds. Again, maintainer of FF would know. Ergo, the question.