Test ID:	1.3.6.1.4.1.25623.1.0.880637
Category:	CentOS Local Security Checks
Title:	CentOS Update for thunderbird CESA-2010:0780 centos5 i386
Summary:	The remote host is missing an update for the 'thunderbird'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'thunderbird' package(s) announced via the referenced advisory. Vulnerability Insight: Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of malformed HTML mail content. An HTML mail message containing malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird. (CVE-2010-3176, CVE-2010-3180) Note: JavaScript support is disabled by default in Thunderbird. The above issues are not exploitable unless JavaScript is enabled. A flaw was found in the script that launches Thunderbird. The LD_LIBRARY_PATH variable was appending a '.' character, which could allow a local attacker to execute arbitrary code with the privileges of a different user running Thunderbird, if that user ran Thunderbird from within an attacker-controlled directory. (CVE-2010-3182) All Thunderbird users should upgrade to this updated package, which resolves these issues. All running instances of Thunderbird must be restarted for the update to take effect. Affected Software/OS: thunderbird on CentOS 5 Solution: Please install the updated packages. CVSS Score: 9.3 CVSS Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2010-3176 BugTraq ID: 44243 http://www.securityfocus.com/bid/44243 Debian Security Information: DSA-2124 (Google Search) http://www.debian.org/security/2010/dsa-2124 http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html http://www.mandriva.com/security/advisories?name=MDVSA-2010:210 http://www.mandriva.com/security/advisories?name=MDVSA-2010:211 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12132 http://www.redhat.com/support/errata/RHSA-2010-0780.html http://www.redhat.com/support/errata/RHSA-2010-0781.html http://www.redhat.com/support/errata/RHSA-2010-0782.html http://www.redhat.com/support/errata/RHSA-2010-0861.html http://www.redhat.com/support/errata/RHSA-2010-0896.html http://secunia.com/advisories/42867 http://www.ubuntu.com/usn/USN-997-1 http://www.ubuntu.com/usn/USN-998-1 http://www.vupen.com/english/advisories/2011/0061 Common Vulnerability Exposure (CVE) ID: CVE-2010-3180 BugTraq ID: 44248 http://www.securityfocus.com/bid/44248 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12158 Common Vulnerability Exposure (CVE) ID: CVE-2010-3182 BugTraq ID: 44251 http://www.securityfocus.com/bid/44251 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13844
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.