| Description: | Summary:
The remote host is missing an update for the 'mozilla-thunderbird' package(s) announced via the SSA:2007-324-01 advisory.
Vulnerability Insight:
New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0,
and -current to fix security issues. Slackware is not vulnerable to either
of these in its default configuration, but watch out if you've enabled
JavaScript.
More information about the security issues may be found here:
[links moved to references]
Here are the details from the Slackware 12.0 ChangeLog:
+--------------------------+
patches/packages/mozilla-thunderbird-2.0.0.9-i686-1.tgz:
Upgraded to thunderbird-2.0.0.9.
This update fixes the following security related issues:
URIs with invalid %-encoding mishandled by Windows (MFSA 2007-36).
Crashes with evidence of memory corruption (MFSA 2007-29).
OK, so the first one obviously does not affect us. :-) The second fix has
to do with the same JavaScript handling problem fixed before in Firefox.
JavaScript is not enabled by default in Thunderbird, and the developers
(at least in MFSA 2007-36) do not recommend turning it on.
For more information, see:
[links moved to references]
(* Security fix *)
+--------------------------+
Affected Software/OS:
'mozilla-thunderbird' package(s) on Slackware 10.2, Slackware 11.0, Slackware 12.0, Slackware current.
Solution:
Please install the updated package(s).
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
