[SECURITY] Fedora 7 Update: thunderbird-2.0.0.14-1.fc7

updates at fedoraproject.org updates at fedoraproject.org
Sat May 10 13:53:22 UTC 2008


--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2008-3519
2008-05-09 22:27:04
--------------------------------------------------------------------------------

Name        : thunderbird
Product     : Fedora 7
Version     : 2.0.0.14
Release     : 1.fc7
URL         : http://www.mozilla.org/projects/thunderbird/
Summary     : Mozilla Thunderbird mail/newsgroup client
Description :
Mozilla Thunderbird is a standalone mail and newsgroup client.

--------------------------------------------------------------------------------
Update Information:

Mozilla Thunderbird is a standalone mail and newsgroup client.    Several flaws
were found in the processing of some malformed HTML mail  content. An HTML mail
message containing such malicious content could cause  Thunderbird to crash or,
potentially, execute arbitrary code as the user  running Thunderbird.
(CVE-2008-1233, CVE-2008-1235, CVE-2008-1236,  CVE-2008-1237)    Several flaws
were found in the display of malformed web content. An HTML  mail message
containing specially-crafted content could, potentially, trick  a user into
surrendering sensitive information. (CVE-2008-1234)    A flaw was found in the
processing of malformed JavaScript content. An HTML  mail message containing
such malicious content could cause Thunderbird to  crash or, potentially,
execute arbitrary code as the user running  Thunderbird. (CVE-2008-1380)
Note: JavaScript support is disabled by default in Thunderbird; the above  issue
is not exploitable unless JavaScript is enabled.    All Thunderbird users should
upgrade to these updated packages, which  contain backported patches to resolve
these issues.
--------------------------------------------------------------------------------
ChangeLog:

* Thu May  1 2008 Christopher Aillon <caillon at redhat.com> 2.0.0.14-1
- Update to 2.0.0.14
* Tue Feb 26 2008 Christopher Aillon <caillon at redhat.com> 2.0.0.12-1
- Update to 2.0.0.12
* Thu Nov 15 2007 Christopher Aillon <caillon at redhat.com> 2.0.0.9-1
- Update to 2.0.0.9
* Wed Jul 25 2007 Martin Stransky <stransky at redhat.com> 2.0.0.5-2
- added ligature pango fix
* Fri Jul 20 2007 Kai Engert <kengert at redhat.com> - 2.0.0.5-1
- 2.0.0.5
* Fri Jun 15 2007 Christopher Aillon <caillon at redhat.com> 2.0.0.4-1
- 2.0.0.4
* Fri Jun  8 2007 Christopher Aillon <caillon at redhat.com> 2.0.0.4-0.rc1
- 2.0.0.4 rc1
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #438721 - CVE-2008-1237 javascript crashes
        https://bugzilla.redhat.com/show_bug.cgi?id=438721
  [ 2 ] Bug #438713 - CVE-2008-1233 Mozilla products XPCNativeWrapper pollution
        https://bugzilla.redhat.com/show_bug.cgi?id=438713
  [ 3 ] Bug #438715 - CVE-2008-1234 universal XSS using event handlers
        https://bugzilla.redhat.com/show_bug.cgi?id=438715
  [ 4 ] Bug #438717 - CVE-2008-1235 chrome privilege via wrong principal
        https://bugzilla.redhat.com/show_bug.cgi?id=438717
  [ 5 ] Bug #438718 - CVE-2008-1236 browser engine crashes
        https://bugzilla.redhat.com/show_bug.cgi?id=438718
  [ 6 ] Bug #440518 - CVE-2008-1380 Firefox JavaScript garbage collection crash
        https://bugzilla.redhat.com/show_bug.cgi?id=440518
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update thunderbird' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------




More information about the Fedora-package-announce mailing list