| Description: | Description:
The remote host is missing an update to thunderbird
announced via advisory FEDORA-2008-3519.
Update Information:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Several flaws were found in the processing of some malformed HTML mail
content. An HTML mail message containing such malicious content could cause
Thunderbird to crash or, potentially, execute arbitrary code as the user
running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236,
CVE-2008-1237)
Several flaws were found in the display of malformed web content. An HTML
mail message containing specially-crafted content could, potentially, trick
a user into surrendering sensitive information. (CVE-2008-1234)
A flaw was found in the processing of malformed JavaScript content. An HTML
mail message containing such malicious content could cause Thunderbird to
crash or, potentially, execute arbitrary code as the user running
Thunderbird. (CVE-2008-1380)
Note: JavaScript support is disabled by default in Thunderbird
the above
issue is not exploitable unless JavaScript is enabled.
All Thunderbird users should upgrade to these updated packages, which
contain backported patches to resolve these issues.
ChangeLog:
* Thu May 1 2008 Christopher Aillon 2.0.0.14-1
- Update to 2.0.0.14
References:
[ 1 ] Bug #438721 - CVE-2008-1237 javascript crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438721
[ 2 ] Bug #438713 - CVE-2008-1233 Mozilla products XPCNativeWrapper pollution
https://bugzilla.redhat.com/show_bug.cgi?id=438713
[ 3 ] Bug #438715 - CVE-2008-1234 universal XSS using event handlers
https://bugzilla.redhat.com/show_bug.cgi?id=438715
[ 4 ] Bug #438717 - CVE-2008-1235 chrome privilege via wrong principal
https://bugzilla.redhat.com/show_bug.cgi?id=438717
[ 5 ] Bug #438718 - CVE-2008-1236 browser engine crashes
https://bugzilla.redhat.com/show_bug.cgi?id=438718
[ 6 ] Bug #440518 - CVE-2008-1380 Firefox JavaScript garbage collection crash
https://bugzilla.redhat.com/show_bug.cgi?id=440518
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update thunderbird' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-3519
Risk factor : Critical
CVSS Score:
9.3
|
