SillyDog701

[beanboy89]

K-Meleon 0.9 was released this past January. At the time of it's release, K-Meleon was using the latest Gecko rendering engine, 1.7.5. Since then, there have been two updates to Gecko due to various security related issues. K-Meleon 0.9 is still using an old, and possibly unsafe core. As a fix th this problem, Holger Metzger has provided a way to upgrade K-Meleon 0.9 to the latest 1.7.7 Gecko engine.

Update K-Meleon 0.9 to use the latest Mozilla Engine

1. Download the zip version of Mozilla 1.7.7. Click here.
2. Unzip the zip file, usually right-clicking on the file and selecting "Extract" should create a folder with the contents of the zip file.
3. With K-Meleon closed, copy the following files and folders from the Mozilla directory you have just created into your existing K-Meleon directory (usually c:\program files\k-meleon) and, when prompted, have existing files overwritten:
* components
* greprefs
* ipc
* res
* all *.dll files in the main directory (where mozilla.exe resides)
4. Start K-Meleon. Help --> About K-Meleon should now report a newer Mozilla version (1.7.7)
5. You may now test http://secunia.com/mozilla_products_arbitrary_memory_exposure_test/

I've tested this method with K-Meleon 0.9 and Mozilla 1.7.7, and it's worked flawlesly.

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.7) Gecko/20050414 K-Meleon/0.9

[Don_HH2K]

This is definitely an interesting method of updating K-Meleon, or for that matter, any Gecko-based browser. It makes me wonder if this would work with some other browser, say, Netscape. If you do what I did with some of the early Donzilla builds and integrate the GRE right with the program (like how the ZIPped builds of Mozilla run), you may just be able to get a crashy Netscape 7.2 based on Mozilla 1.7.7. And if you want my opinion, there's a market for that.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Donzilla/0.7PR1.5 (wml/1.3)

[dmbtech]

I believe it would be easy enough to post an actual binary update without recompiling the whole thing that way. Why not just make an xpi and installs the update? Does Kmelion support xpis?

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20050106 Firefox/1.0

[Don_HH2K]

No K-Meleon doesn't support XPI files.

Getting back to an XPI installer, though, that isn't possible, as your operating system would report that the files are already in use (since they are, and you'd be trying to write over them). It would be good if somebody could come up with a native way of doing it with Netscape closed, say, with an MS-DOS batch file or an MSI package.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Donzilla/0.7PR1.5 (wml/1.3)

[dmbtech]

If i remember correctly, firefox used to do that when upgrading the preview released, it was able to replace the old files with the new files, and after you restarted it works. On linux of coarse, im able to that no matter what.

UserAgent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8b2) Gecko/20050503 Firefox/1.0+

[Pu7o]

I wonder, would this work with Camino?

UserAgent: Mozilla/5.0 (compatible; Konqueror/3.2; Darwin 7.9.0; X11; Power Macintosh; ) (KHTML, like Gecko)

[DJGM]

I wonder, would this work with Camino?

Since K-Meleon is a Windows only browser, the above method will only work on Windows.
Although I'm sure someone could find a Mac version of that method to work on Camino.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

[burnerO]

This seems to also work to some extent for Netscape 8.

I copied components, grep, res and all dlls from the root directory of a Firefox 1.0.4 installation and it seems to have patched at least this exploit:
http://secunia.com/mozilla_products_arb ... sure_test/

The spoofing exploit is still flawed, but this ought to be investigated by someone with more of a clue than myself.

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.5) Gecko/20050308 Firefox/0.9.6

[Josh]

App Suite 1.7.8 is the new release. It fixes some of the vulns found this week. I used the instructions found in this thread, and it works!

Thanks everyone!

UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 K-Meleon/0.9

[beanboy89]

An update for this thread:

The above method for updating the Gecko inside K-Meleon no longer works with recent versions of Mozilla. I belive it broke sometime after the Mozilla 1.7.8 release; if the original way of updating was tried with a more recent Mozilla build, it caused K-Meleon to "break," or simply refuse to run, accompanied with a slew of error messages.

Holger Metzger has provided updated instructions for updating K-Meleon's rendering engine on his website.

Update K-Meleon 0.9 to use the latest Mozilla Engine

1. Download the ZIP-version of Mozilla 1.7.12. Click here (you may also use any Mozilla 1.7.x nightly)
2. Unzip the ZIP file (usually right-clicking on the file and selecting »Extract« should create a folder with the contents of the file).
3. With K-Meleon closed, copy the following files and folders from the Mozilla directory you have just created into your existing K-Meleon directory (default is c:\program files\k-meleon) and, when prompted, have existing files overwritten:
* components
* ipc
* res
* in /chrome/: toolkit.jar
* all *.dll files in the main directory (where mozilla.exe resides).
Note: This is the »quick'n'dirty« way; the cleaner procedure would be to just copy the same files that can be found in the K-Meleon directory. This can be accomplished with "xcopy", e.g.
xcopy c:\mozilla\*.* %programfiles%\K-Meleon\ /U /Q /Y
You may want to create a batch file that automates the process of updating (see kmeleon.bat)
* Please note: after you copied the files you have to delete the following two files in the \components\ folder: compreg.dat, xpti.dat. Deleting these two files is necessary so that the history works correctly in K-Meleon.
* It may also be a good idea to get rid of (i.e. delete) chrome.rdf in c:\program files\K-Meleon\Profiles\...\chrome\ so that K-Meleon will be able to pick up changes correctly. Sometimes it may also be necessary to delete overlayinfo.* in the same Profile folder.
* Start K-Meleon. Help --> About K-Meleon should now report an up-to-date Mozilla version (1.7.10)
* There are more (unofficial) builds of K-Meleon available already featuring new Gecko-Engines (and much more). Visit the K-Meleon forums for details.

I have successfully updated K-Meleon 0.9 to run on Gecko 1.7.12 with the revised method.

UserAgent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.12) Gecko/20050915 K-Meleon/0.9