--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2008-3519
2008-05-09 22:27:04
--------------------------------------------------------------------------------
Name : thunderbird
Product : Fedora 7
Version : 2.0.0.14
Release : 1.fc7
URL :
http://www.mozilla.org/projects/thunderbird/
Summary : Mozilla Thunderbird mail/newsgroup client
Description :
Mozilla Thunderbird is a standalone mail and newsgroup client.
--------------------------------------------------------------------------------
Update Information:
Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws
were found in the processing of some malformed HTML mail content. An HTML mail
message containing such malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237) Several flaws
were found in the display of malformed web content. An HTML mail message
containing specially-crafted content could, potentially, trick a user into
surrendering sensitive information. (CVE-2008-1234) A flaw was found in the
processing of malformed JavaScript content. An HTML mail message containing
such malicious content could cause Thunderbird to crash or, potentially,
execute arbitrary code as the user running Thunderbird. (CVE-2008-1380)
Note: JavaScript support is disabled by default in Thunderbird; the above issue
is not exploitable unless JavaScript is enabled. All Thunderbird users should
upgrade to these updated packages, which contain backported patches to resolve
these issues.
--------------------------------------------------------------------------------
ChangeLog:
* Thu May 1 2008 Christopher Aillon <caillon@redhat.com> 2.0.0.14-1
- Update to 2.0.0.14
* Tue Feb 26 2008 Christopher Aillon <caillon@redhat.com> 2.0.0.12-1
- Update to 2.0.0.12
* Thu Nov 15 2007 Christopher Aillon <caillon@redhat.com> 2.0.0.9-1
- Update to 2.0.0.9
* Wed Jul 25 2007 Martin Stransky <stransky@redhat.com> 2.0.0.5-2
- added ligature pango fix
* Fri Jul 20 2007 Kai Engert <kengert@redhat.com> - 2.0.0.5-1
- 2.0.0.5
* Fri Jun 15 2007 Christopher Aillon <caillon@redhat.com> 2.0.0.4-1
- 2.0.0.4
* Fri Jun 8 2007 Christopher Aillon <caillon@redhat.com> 2.0.0.4-0.rc1
- 2.0.0.4 rc1
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #438721 - CVE-2008-1237 javascript crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438721
[ 2 ] Bug #438713 - CVE-2008-1233 Mozilla products XPCNativeWrapper pollution
https://bugzilla.redhat.com/show_bug.cgi?id=438713
[ 3 ] Bug #438715 - CVE-2008-1234 universal XSS using event handlers
https://bugzilla.redhat.com/show_bug.cgi?id=438715
[ 4 ] Bug #438717 - CVE-2008-1235 chrome privilege via wrong principal
https://bugzilla.redhat.com/show_bug.cgi?id=438717
[ 5 ] Bug #438718 - CVE-2008-1236 browser engine crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438718
[ 6 ] Bug #440518 - CVE-2008-1380 Firefox JavaScript garbage collection crash
https://bugzilla.redhat.com/show_bug.cgi?id=440518
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update thunderbird' at the command line.
For more information, refer to "Managing Software with yum",
available at
http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
http://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
Fedora-package-announce mailing list
Fedora-package-announce@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-package-announce
