Last week was an insanely busy week. There was a critical Ekiga flaw discovered along with a Firefox update on Friday.
The Ekiga flaw was dropped on us from the blue. When Red Hat discovers a critical 0day flaw such as this, we drop everything and make it our top priority. It turned out that if a user is running Ekiga and can receive a call, it would be possible to execute arbitrary code as that user. The scariest thing about this flaw is that the victim doesn't need to do anything other than have Ekiga running.
The Firefox update was on a Friday. This was the choice of upstream, they decided it was worth doing a Friday update since there were a number of public flaws this update fixes. We don't usually like to release major updates right before a weekend, but given the high profile nature of the flaw, we felt it was worth doing. While it made for a long Friday, it was easily worth it.
Security Updates
I expect the month of PHP bugs to start next week. I'm not sure what it will bring, but the Red Hat Security Response Team is as prepared as we can be for this. Hopefully next week's review will be boring. I doubt it, but a little hope never hurts.
