According to the analysis by Mike Kuketz
(https://www.kuketz-blog.de/wot-addon-wie-ein-browser-addon-seine-nutzer-ausspaeht/),
the (most?) problematic commit is of 2015-04-20
(https://github.com/mywot/firefox-xul/commit/0df107cae8ac18901bd665acace4b369c244a3f9).
This would mean, that users of
Package: ublock-origin
Version: 1.9.16+dfsg-1
Severity: wishlist
After adblock-plus getting a bad reputation for its
"acceptable ads" policy, ublock-origin is often recommended
as alternative. It would be nice to have it in stable, too.
The backport itself is trivial, IIRC.
I can take care of
I don't think, that removing this package from Debian is the right
way. Users who have it installed get no notice and would keep this
(apparent) malware. There should be a new package version, that does
not contain the plugin anymore (like transitional packages), for
both stable-sec and unstable
Package: enigmail
Version: 2:1.9.8.1-1~deb9u1
Severity: important
Tags: security
When clicking on "Download missing keys" in the "Enigmail Key
Selection" window, a new window "Download OpenPGP Keys" appears. It
shows the columns, "Account / User ID", "Created", and "Key ID".
Unfortunately, the
Package: wnpp
Severity: wishlist
* Package name: xul-ext-cardbook
Version : 23.6
Upstream Author : Philippe Vigneau
* URL : https://github.com/CardBook/CardBook
* License : MPL-2.0
Programming Lang: JavaScript
Description : Thunderbird address book
