[SECURITY] Fedora 8 Update: thunderbird-2.0.0.14-1.fc8
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2008-3557
2008-05-09 22:33:22
--------------------------------------------------------------------------------
Name : thunderbird
Product : Fedora 8
Version : 2.0.0.14
Release : 1.fc8
URL : http://www.mozilla.org/projects/thunderbird/
Summary : Mozilla Thunderbird mail/newsgroup client
Description :
Mozilla Thunderbird is a standalone mail and newsgroup client.
--------------------------------------------------------------------------------
Update Information:
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws
were found in the processing of some malformed HTML mail content. An HTML mail
message containing such malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237) Several flaws
were found in the display of malformed web content. An HTML mail message
containing specially-crafted content could, potentially, trick a user into
surrendering sensitive information. (CVE-2008-1234) A flaw was found in the
processing of malformed JavaScript content. An HTML mail message containing
such malicious content could cause Thunderbird to crash or, potentially,
execute arbitrary code as the user running Thunderbird. (CVE-2008-1380)
Note: JavaScript support is disabled by default in Thunderbird; the above issue
is not exploitable unless JavaScript is enabled. All Thunderbird users should
upgrade to these updated packages, which contain backported patches to resolve
these issues.
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 1 2008 Christopher Aillon <caillon(a)redhat.com> 2.0.0.14-1
- Update to 2.0.0.14
* Fri Mar 7 2008 Martin Stransky <stransky(a)redhat.com>
- updated starting script, fixes #436410
* Tue Feb 26 2008 Christopher Aillon <caillon(a)redhat.com> 2.0.0.12-1
- Update to 2.0.0.12
* Thu Nov 15 2007 Christopher Aillon <caillon(a)redhat.com> 2.0.0.9-1
- Update to 2.0.0.9
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #438713 - CVE-2008-1233 Mozilla products XPCNativeWrapper pollution
https://bugzilla.redhat.com/show_bug.cgi?id=438713
[ 2 ] Bug #438715 - CVE-2008-1234 universal XSS using event handlers
https://bugzilla.redhat.com/show_bug.cgi?id=438715
[ 3 ] Bug #438717 - CVE-2008-1235 chrome privilege via wrong principal
https://bugzilla.redhat.com/show_bug.cgi?id=438717
[ 4 ] Bug #440518 - CVE-2008-1380 Firefox JavaScript garbage collection crash
https://bugzilla.redhat.com/show_bug.cgi?id=440518
[ 5 ] Bug #438718 - CVE-2008-1236 browser engine crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438718
[ 6 ] Bug #438721 - CVE-2008-1237 javascript crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438721
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update thunderbird' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------