package: icedove
version: 3.0~rc2
severity: important
tags: security

Hi,

Your package embeds source code from xulrunner, which makes
security updates very cumbersome, difficult, and potentially
error-prone.  Please update your package to make use of the
shared library.  Thank you for your attention on this matter.

Best wishes,
Mike

forwarded 561750 https://bugzilla.mozilla.org/show_bug.cgi?id=306324
tag 561750 + upstream
thanks

This is known, and not possible (yet). Likewise for iceape.

The main difference with the situation in lenny is that the mozilla/
directory in iceape and icedove 3 sources are the same as the
xulrunner-1.9.1 source, which will make updates easier.

This is the main reason why I'm seriously considering shipping iceweasel
3.5.x with squeeze instead of 3.6.x.

Mike