| Description: | Description:
The remote host is missing an update to mozilla-thunderbird
announced via advisory USN-400-1.
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
Details follow:
Georgi Guninski and David Bienvenu discovered that long Content-Type and
RFC2047-encoded headers we vulnerable to heap overflows. By tricking
the user into opening a specially crafted email, an attacker could
execute arbitrary code with user privileges. (CVE-2006-6506)
Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges or bypass internal XSS protections
by tricking the user into opening a malicious email containing
JavaScript. Please note that JavaScript is disabled by default for
emails, and it is not recommended to enable it. (CVE-2006-6497,
CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502,
CVE-2006-6503)
Solution:
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
mozilla-thunderbird 1.5.0.9-0ubuntu0.5.10
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.5.10
Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.9-0ubuntu0.6.06
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.6.06
Ubuntu 6.10:
mozilla-thunderbird 1.5.0.9-0ubuntu0.6.10
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.6.10
After a standard system upgrade you need to restart Thunderbird to
effect the necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-400-1
Risk factor : High
CVSS Score:
7.1
|
