FAQ Search Today's Posts Mark Forums Read

» Linux Archive
Home
New Posts
Search
FAQ


Go Back   Linux Archive > Redhat > Enterprise Watch List
Reload this Page Moderate: thunderbird security update

 
 
LinkBack Thread Tools
 
Old 02-08-2008, 01:53 AM
 
Default Moderate: thunderbird security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: thunderbird security update
Advisory ID: RHSA-2008:0105-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0105.html
Issue date: 2008-02-07
CVE Names: CVE-2008-0412 CVE-2008-0413 CVE-2008-0415
CVE-2008-0418 CVE-2008-0419 CVE-2008-0591
CVE-2008-0592 CVE-2008-0593
================================================== ===================

1. Summary:

Updated thunderbird packages that fix several security issues are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way Thunderbird processed certain malformed
HTML mail content. A HTML mail message containing malicious content could
cause Thunderbird to crash, or potentially execute arbitrary code as the
user running Thunderbird. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415,
CVE-2008-0419)

Several flaws were found in the way Thunderbird displayed malformed HTML
mail content. A HTML mail message containing specially-crafted content
could trick a user into surrendering sensitive information. (CVE-2008-0591,
CVE-2008-0593)

A flaw was found in the way Thunderbird handles certain chrome URLs. If a
user has certain extensions installed, it could allow a malicious HTML mail
message to steal sensitive session data. Note: this flaw does not affect a
default installation of Thunderbird. (CVE-2008-0418)

Note: JavaScript support is disabled by default in Thunderbird; the above
issues are not exploitable unless JavaScript is enabled.

A flaw was found in the way Thunderbird saves certain text files. If a
remote site offers a file of type "plain/text", rather than "text/plain",
Thunderbird will not show future "text/plain" content to the user, forcing
them to save those files locally to view the content. (CVE-2008-0592)

Users of thunderbird are advised to upgrade to these updated packages,
which contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

431732 - CVE-2008-0412 Mozilla layout engine crashes
431733 - CVE-2008-0413 Mozilla javascript engine crashes
431739 - CVE-2008-0415 Mozilla arbitrary code execution
431748 - CVE-2008-0418 Mozilla chrome: directory traversal
431749 - CVE-2008-0419 Mozilla arbitrary code execution
431751 - CVE-2008-0591 Mozilla information disclosure flaw
431752 - CVE-2008-0592 Mozilla text file mishandling
431756 - CVE-2008-0593 Mozilla URL token stealing flaw

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm

i386:
thunderbird-1.5.0.12-8.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-8.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm

ppc:
thunderbird-1.5.0.12-8.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.ppc.rpm

s390:
thunderbird-1.5.0.12-8.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.s390.rpm

s390x:
thunderbird-1.5.0.12-8.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.s390x.rpm

x86_64:
thunderbird-1.5.0.12-8.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm

i386:
thunderbird-1.5.0.12-8.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm

x86_64:
thunderbird-1.5.0.12-8.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm

i386:
thunderbird-1.5.0.12-8.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-8.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-8.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm

i386:
thunderbird-1.5.0.12-8.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-8.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-8.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-1.5.0.12-8.el5.src.rpm

i386:
thunderbird-1.5.0.12-8.el5.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el5.i386.rpm

x86_64:
thunderbird-1.5.0.12-8.el5.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el5.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-1.5.0.12-8.el5.src.rpm

i386:
thunderbird-1.5.0.12-8.el5.i386.rpm
thunderbird-debuginfo-1.5.0.12-8.el5.i386.rpm

x86_64:
thunderbird-1.5.0.12-8.el5.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-8.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0412
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0413
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0415
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0418
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0419
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0591
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0592
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0593
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFHq8QqXlSAg2UNWIIRAkeSAKCb0Z6TlRf+Lc+gLbAmnP IxfZzH8QCeNSAd
gw1nkQjp37VBpoKHN40PdcE=
=Qqed
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 
Old 04-03-2008, 04:19 PM
 
Default Moderate: thunderbird security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: thunderbird security update
Advisory ID: RHSA-2008:0209-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0209.html
Issue date: 2008-04-03
CVE Names: CVE-2008-1233 CVE-2008-1234 CVE-2008-1235
CVE-2008-1236 CVE-2008-1237 CVE-2008-1238
CVE-2008-1241
================================================== ===================

1. Summary:

Updated thunderbird packages that fix several security issues are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of some malformed HTML mail
content. An HTML mail message containing such malicious content could cause
Thunderbird to crash or, potentially, execute arbitrary code as the user
running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236,
CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML
mail message containing specially-crafted content could, potentially, trick
a user into surrendering sensitive information. (CVE-2008-1234,
CVE-2008-1238, CVE-2008-1241)

Note: JavaScript support is disabled by default in Thunderbird; the above
issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which
contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

438713 - CVE-2008-1233 Mozilla products XPCNativeWrapper pollution
438715 - CVE-2008-1234 universal XSS using event handlers
438717 - CVE-2008-1235 chrome privilege via wrong principal
438718 - CVE-2008-1236 browser engine crashes
438721 - CVE-2008-1237 javascript crashes
438724 - CVE-2008-1238 Referrer spoofing bug
438730 - CVE-2008-1241 XUL popup spoofing

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-10.el4.src.rpm

i386:
thunderbird-1.5.0.12-10.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-10.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.ia64.rpm

ppc:
thunderbird-1.5.0.12-10.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.ppc.rpm

s390:
thunderbird-1.5.0.12-10.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.s390.rpm

s390x:
thunderbird-1.5.0.12-10.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.s390x.rpm

x86_64:
thunderbird-1.5.0.12-10.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-10.el4.src.rpm

i386:
thunderbird-1.5.0.12-10.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.i386.rpm

x86_64:
thunderbird-1.5.0.12-10.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-10.el4.src.rpm

i386:
thunderbird-1.5.0.12-10.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-10.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-10.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-10.el4.src.rpm

i386:
thunderbird-1.5.0.12-10.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-10.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-10.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-10.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-1.5.0.12-11.el5_1.src.rpm

i386:
thunderbird-1.5.0.12-11.el5_1.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el5_1.i386.rpm

x86_64:
thunderbird-1.5.0.12-11.el5_1.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el5_1.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-1.5.0.12-11.el5_1.src.rpm

i386:
thunderbird-1.5.0.12-11.el5_1.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el5_1.i386.rpm

x86_64:
thunderbird-1.5.0.12-11.el5_1.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el5_1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1233
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1234
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1235
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1236
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1238
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1241
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFH9QOoXlSAg2UNWIIRAgDMAKC/9F4HioOnN++7eHJ0g/ujaq4OuQCdHH8D
/NhwwTWCPX4aYTWyIK1IkMY=
=jioU
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 
Old 04-30-2008, 04:48 PM
 
Default Moderate: thunderbird security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: thunderbird security update
Advisory ID: RHSA-2008:0224-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0224.html
Issue date: 2008-04-30
CVE Names: CVE-2008-1380
================================================== ===================

1. Summary:

Updated thunderbird packages that fix a security issue are now available
for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

A flaw was found in the processing of malformed JavaScript content. An HTML
mail message containing such malicious content could cause Thunderbird to
crash or, potentially, execute arbitrary code as the user running
Thunderbird. (CVE-2008-1380)

Note: JavaScript support is disabled by default in Thunderbird; the above
issue is not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which
contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

440518 - CVE-2008-1380 Firefox JavaScript garbage collection crash

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-11.el4.src.rpm

i386:
thunderbird-1.5.0.12-11.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-11.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.ia64.rpm

ppc:
thunderbird-1.5.0.12-11.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.ppc.rpm

s390:
thunderbird-1.5.0.12-11.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.s390.rpm

s390x:
thunderbird-1.5.0.12-11.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.s390x.rpm

x86_64:
thunderbird-1.5.0.12-11.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-11.el4.src.rpm

i386:
thunderbird-1.5.0.12-11.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.i386.rpm

x86_64:
thunderbird-1.5.0.12-11.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-11.el4.src.rpm

i386:
thunderbird-1.5.0.12-11.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-11.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-11.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-11.el4.src.rpm

i386:
thunderbird-1.5.0.12-11.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-11.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-11.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-11.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-1.5.0.12-12.el5_1.src.rpm

i386:
thunderbird-1.5.0.12-12.el5_1.i386.rpm
thunderbird-debuginfo-1.5.0.12-12.el5_1.i386.rpm

x86_64:
thunderbird-1.5.0.12-12.el5_1.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-12.el5_1.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-1.5.0.12-12.el5_1.src.rpm

i386:
thunderbird-1.5.0.12-12.el5_1.i386.rpm
thunderbird-debuginfo-1.5.0.12-12.el5_1.i386.rpm

x86_64:
thunderbird-1.5.0.12-12.el5_1.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-12.el5_1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1380
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFIGKLHXlSAg2UNWIIRAiB6AKC3wktWvXMEOR0dLjpXTA OOwmBz1ACbBhaK
riC9xpEQM/+6sksZXGy/1qE=
=JXiO
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 
Old 07-24-2008, 12:04 AM
 
Default Moderate: thunderbird security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

================================================== ===================
Red Hat Security Advisory

Synopsis: Moderate: thunderbird security update
Advisory ID: RHSA-2008:0616-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0616.html
Issue date: 2008-07-23
CVE Names: CVE-2008-2785 CVE-2008-2798 CVE-2008-2799
CVE-2008-2800 CVE-2008-2801 CVE-2008-2802
CVE-2008-2803 CVE-2008-2805 CVE-2008-2807
CVE-2008-2808 CVE-2008-2809 CVE-2008-2810
CVE-2008-2811
================================================== ===================

1. Summary:

Updated thunderbird packages that fix a security issue are now available
for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

Multiple flaws were found in the processing of malformed JavaScript
content. An HTML mail containing such malicious content could cause
Thunderbird to crash or, potentially, execute arbitrary code as the user
running Thunderbird. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

Several flaws were found in the processing of malformed HTML content. An
HTML mail containing malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

Several flaws were found in the way malformed HTML content was displayed.
An HTML mail containing specially-crafted content could, potentially, trick
a Thunderbird user into surrendering sensitive information. (CVE-2008-2800)

Two local file disclosure flaws were found in Thunderbird. An HTML mail
containing malicious content could cause Thunderbird to reveal the contents
of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

A flaw was found in the way a malformed .properties file was processed by
Thunderbird. A malicious extension could read uninitialized memory,
possibly leaking sensitive data to the extension. (CVE-2008-2807)

A flaw was found in the way Thunderbird escaped a listing of local file
names. If a user could be tricked into listing a local directory containing
malicious file names, arbitrary JavaScript could be run with the
permissions of the user running Thunderbird. (CVE-2008-2808)

A flaw was found in the way Thunderbird displayed information about
self-signed certificates. It was possible for a self-signed certificate to
contain multiple alternate name entries, which were not all displayed to
the user, allowing them to mistakenly extend trust to an unknown site.
(CVE-2008-2809)

Note: JavaScript support is disabled by default in Thunderbird. The above
issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which
contain backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bugs fixed (http://bugzilla.redhat.com/):

452204 - CVE-2008-2785 mozilla: CSS reference counter overflow (ZDI-CAN-349)
452597 - CVE-2008-2798 Firefox malformed web content flaws
452598 - CVE-2008-2799 Firefox javascript arbitrary code execution
452599 - CVE-2008-2800 Firefox XSS attacks
452600 - CVE-2008-2802 Firefox arbitrary JavaScript code execution
452602 - CVE-2008-2803 Firefox javascript arbitrary code execution
452604 - CVE-2008-2805 Firefox arbitrary file disclosure
452605 - CVE-2008-2801 Firefox arbitrary signed JAR code execution
452709 - CVE-2008-2807 Firefox .properties memory leak
452710 - CVE-2008-2808 Firefox file location escaping flaw
452711 - CVE-2008-2809 Firefox self signed certificate flaw
452712 - CVE-2008-2810 Firefox arbitrary file disclosure
453007 - CVE-2008-2811 Firefox block reflow flaw

6. Package List:

Red Hat Enterprise Linux AS version 4:

Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-14.el4.src.rpm

i386:
thunderbird-1.5.0.12-14.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-14.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.ia64.rpm

ppc:
thunderbird-1.5.0.12-14.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.ppc.rpm

s390:
thunderbird-1.5.0.12-14.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.s390.rpm

s390x:
thunderbird-1.5.0.12-14.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.s390x.rpm

x86_64:
thunderbird-1.5.0.12-14.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-14.el4.src.rpm

i386:
thunderbird-1.5.0.12-14.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.i386.rpm

x86_64:
thunderbird-1.5.0.12-14.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-14.el4.src.rpm

i386:
thunderbird-1.5.0.12-14.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-14.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-14.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-14.el4.src.rpm

i386:
thunderbird-1.5.0.12-14.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.i386.rpm

ia64:
thunderbird-1.5.0.12-14.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.ia64.rpm

x86_64:
thunderbird-1.5.0.12-14.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-14.el4.x86_64.rpm

Red Hat Enterprise Linux Desktop (v. 5 client):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-2.0.0.16-1.el5.src.rpm

i386:
thunderbird-2.0.0.16-1.el5.i386.rpm
thunderbird-debuginfo-2.0.0.16-1.el5.i386.rpm

x86_64:
thunderbird-2.0.0.16-1.el5.x86_64.rpm
thunderbird-debuginfo-2.0.0.16-1.el5.x86_64.rpm

RHEL Optional Productivity Applications (v. 5 server):

Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-2.0.0.16-1.el5.src.rpm

i386:
thunderbird-2.0.0.16-1.el5.i386.rpm
thunderbird-debuginfo-2.0.0.16-1.el5.i386.rpm

x86_64:
thunderbird-2.0.0.16-1.el5.x86_64.rpm
thunderbird-debuginfo-2.0.0.16-1.el5.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2785
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2798
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2799
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2800
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2801
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2809
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2811
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2008 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFIh8bOXlSAg2UNWIIRAqV5AJ90I0bqntzHqBP84a4DhS 540CwU7QCfT9U+
5kg9P4DZwj9C45lSl2SH9/g=
=TTi/
-----END PGP SIGNATURE-----


--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
 

Thread Tools




All times are GMT. The time now is 06:03 AM.

VBulletin, Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org

Contact Us - Linux Archive - Archive - Top -