Test ID:	1.3.6.1.4.1.25623.1.0.59763
Category:	Fedora Local Security Checks
Title:	Fedora Core 7 FEDORA-2007-1180 (thunderbird)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to thunderbird announced via advisory FEDORA-2007-1180. Mozilla Thunderbird is a standalone mail and newsgroup client. Update Information: Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML email message containing JavaScript code could cause Thunderbird to crash or potentially execute arbitrary code as the user running Thunderbird. JavaScript support is disabled by default in Thunderbird these issues are not exploitable unless the user has enabled JavaScript. (CVE-2007-3089, CVE-2007-3734, CVE-2007-3735, CVE-2007-3736, CVE-2007-3737, CVE-2007-3738) Users of Thunderbird are advised to upgrade to these erratum packages, which contain patches that correct these issues. ChangeLog: * Fri Jul 20 2007 Kai Engert - 2.0.0.5-1 - 2.0.0.5 * Fri Jun 15 2007 Christopher Aillon 2.0.0.4-1 - 2.0.0.4 * Fri Jun 8 2007 Christopher Aillon 2.0.0.4-0.rc1 - 2.0.0.4 rc1 References: [ 1 ] Bug #248518 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=248518 [ 2 ] CVE-2007-3734 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3734 [ 3 ] CVE-2007-3735 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3735 [ 4 ] CVE-2007-3736 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3736 [ 5 ] CVE-2007-3089 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3089 [ 6 ] CVE-2007-3737 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3737 [ 7 ] CVE-2007-3738 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3738 Updated packages: 406b91a7a359a5116abc1de38d66f02475330193 thunderbird-2.0.0.5-1.fc7.ppc64.rpm 2b7400c86c54e4b77fda5c8c5d7f6e57e3a4eadb thunderbird-debuginfo-2.0.0.5-1.fc7.ppc64.rpm f7f02885088254a8257fd6d20728785a600adaf5 thunderbird-debuginfo-2.0.0.5-1.fc7.i386.rpm 34c53a1f3b96d014e8bb6ca02704590be0baa980 thunderbird-2.0.0.5-1.fc7.i386.rpm 4d5328a7b0744d9cb9f73648e959c0cc7d62dee1 thunderbird-debuginfo-2.0.0.5-1.fc7.x86_64.rpm 1c57f5e01d960b6a0600cc7817764f13602058e7 thunderbird-2.0.0.5-1.fc7.x86_64.rpm 1c5eaadb7684dac209c38b9f1fcff1a002caed2c thunderbird-debuginfo-2.0.0.5-1.fc7.ppc.rpm 0fe3b5c19898df0c2976fdc8e19482dbe0903707 thunderbird-2.0.0.5-1.fc7.ppc.rpm d8525d565bd1523e8763f0aee0ec463257af98e2 thunderbird-2.0.0.5-1.fc7.src.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at http://docs.fedoraproject.org/yum/. Solution: Apply the appropriate updates. http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2007-1180 Risk factor : Critical CVSS Score: 9.3
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-3089 BugTraq ID: 24286 http://www.securityfocus.com/bid/24286 Bugtraq: 20070604 Assorted browser vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/470446/100/0/threaded Bugtraq: 20070720 rPSA-2007-0148-1 firefox thunderbird (Google Search) http://www.securityfocus.com/archive/1/474226/100/0/threaded Bugtraq: 20070724 FLEA-2007-0033-1: firefox thunderbird (Google Search) http://www.securityfocus.com/archive/1/474542/100/0/threaded Cert/CC Advisory: TA07-199A http://www.us-cert.gov/cas/techalerts/TA07-199A.html CERT/CC vulnerability note: VU#143297 http://www.kb.cert.org/vuls/id/143297 Debian Security Information: DSA-1337 (Google Search) http://www.debian.org/security/2007/dsa-1337 Debian Security Information: DSA-1338 (Google Search) http://www.debian.org/security/2007/dsa-1338 Debian Security Information: DSA-1339 (Google Search) http://www.debian.org/security/2007/dsa-1339 http://archives.neohapsis.com/archives/fulldisclosure/2007-06/0026.html http://www.gentoo.org/security/en/glsa/glsa-200708-09.xml HPdes Security Advisory: HPSBUX02153 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742 HPdes Security Advisory: SSRT061181 http://www.mandriva.com/security/advisories?name=MDKSA-2007:152 http://lcamtuf.coredump.cx/ifsnatch/ https://bugzilla.mozilla.org/show_bug.cgi?id=381300 https://bugzilla.mozilla.org/show_bug.cgi?id=382686 http://osvdb.org/38024 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11122 http://www.redhat.com/support/errata/RHSA-2007-0722.html http://www.redhat.com/support/errata/RHSA-2007-0723.html http://www.redhat.com/support/errata/RHSA-2007-0724.html http://www.securitytracker.com/id?1018412 http://secunia.com/advisories/25589 http://secunia.com/advisories/26072 http://secunia.com/advisories/26095 http://secunia.com/advisories/26103 http://secunia.com/advisories/26106 http://secunia.com/advisories/26107 http://secunia.com/advisories/26149 http://secunia.com/advisories/26151 http://secunia.com/advisories/26159 http://secunia.com/advisories/26179 http://secunia.com/advisories/26204 http://secunia.com/advisories/26205 http://secunia.com/advisories/26211 http://secunia.com/advisories/26216 http://secunia.com/advisories/26258 http://secunia.com/advisories/26271 http://secunia.com/advisories/26460 http://secunia.com/advisories/28135 SGI Security Advisory: 20070701-01-P ftp://patches.sgi.com/support/free/security/advisories/20070701-01-P.asc http://securityreason.com/securityalert/2781 http://sunsolve.sun.com/search/document.do?assetkey=1-26-103177-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1 SuSE Security Announcement: SUSE-SA:2007:049 (Google Search) http://www.novell.com/linux/security/advisories/2007_49_mozilla.html http://www.ubuntu.com/usn/usn-490-1 http://www.vupen.com/english/advisories/2007/2564 http://www.vupen.com/english/advisories/2007/4256 XForce ISS Database: firefox-iframe-security-bypass(34701) https://exchange.xforce.ibmcloud.com/vulnerabilities/34701 Common Vulnerability Exposure (CVE) ID: CVE-2007-3734 1018408 http://www.securitytracker.com/id?1018408 103177 20070701-01-P 20070720 rPSA-2007-0148-1 firefox thunderbird 20070724 FLEA-2007-0033-1: firefox thunderbird 201516 24946 http://www.securityfocus.com/bid/24946 25589 26072 26095 26096 http://secunia.com/advisories/26096 26103 26106 26107 26149 26151 26159 26176 http://secunia.com/advisories/26176 26179 26204 26205 26211 26216 26258 26271 26460 26572 http://secunia.com/advisories/26572 27326 http://secunia.com/advisories/27326 28135 28363 http://secunia.com/advisories/28363 ADV-2007-2564 ADV-2007-2565 http://www.vupen.com/english/advisories/2007/2565 ADV-2007-4256 ADV-2008-0082 http://www.vupen.com/english/advisories/2008/0082 DSA-1337 DSA-1338 DSA-1339 DSA-1391 http://www.debian.org/security/2007/dsa-1391 GLSA-200708-09 HPSBUX02153 HPSBUX02156 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579 MDKSA-2007:152 MDVSA-2007:047 http://www.mandriva.com/security/advisories?name=MDVSA-2007:047 MDVSA-2008:047 http://www.mandriva.com/security/advisories?name=MDVSA-2008:047 RHSA-2007:0722 RHSA-2007:0723 RHSA-2007:0724 SSRT061181 SSRT061236 SUSE-SA:2007:049 USN-490-1 USN-503-1 http://www.ubuntu.com/usn/usn-503-1 ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html http://www.mozilla.org/security/announce/2007/mfsa2007-18.html mozilla-browser-engine-code-execution(35458) https://exchange.xforce.ibmcloud.com/vulnerabilities/35458 oval:org.mitre.oval:def:10108 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10108 Common Vulnerability Exposure (CVE) ID: CVE-2007-3735 mozilla-javascript-eng-code-execution(35459) https://exchange.xforce.ibmcloud.com/vulnerabilities/35459 oval:org.mitre.oval:def:11066 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11066 Common Vulnerability Exposure (CVE) ID: CVE-2007-3736 1018410 http://www.securitytracker.com/id?1018410 http://www.mozilla.org/security/announce/2007/mfsa2007-19.html mozilla-addeventlistener-settimeout-xss(35462) https://exchange.xforce.ibmcloud.com/vulnerabilities/35462 oval:org.mitre.oval:def:11749 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11749 Common Vulnerability Exposure (CVE) ID: CVE-2007-3737 1018409 http://www.securitytracker.com/id?1018409 firefox-eventhandler-code-execution(35461) https://exchange.xforce.ibmcloud.com/vulnerabilities/35461 http://www.mozilla.org/security/announce/2007/mfsa2007-21.html oval:org.mitre.oval:def:10009 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10009 Common Vulnerability Exposure (CVE) ID: CVE-2007-3738 1018414 http://www.securitytracker.com/id?1018414 SUSE-SA:2007:057 http://www.novell.com/linux/security/advisories/2007_57_mozilla.html firefox-xpcnativewrapper-code-execution(35460) https://exchange.xforce.ibmcloud.com/vulnerabilities/35460 http://www.mozilla.org/security/announce/2007/mfsa2007-25.html oval:org.mitre.oval:def:9875 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9875
Copyright	Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.