English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 123947 CVE descriptions
and 58962 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.61428
Category:Fedora Local Security Checks
Title:Fedora Core 9 FEDORA-2008-6737 (thunderbird)
Summary:Fedora Core 9 FEDORA-2008-6737 (thunderbird)
Description:Description:

The remote host is missing an update to thunderbird
announced via advisory FEDORA-2008-6737.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Update Information:

Updated thunderbird packages that fix several security issues are now available
for Fedora 9. Several flaws were found in the processing of malformed HTML
content. An HTML mail containing malicious content could cause Thunderbird to
crash or, potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2811) Multiple flaws
were found in the processing of malformed JavaScript content. An HTML mail
containing such malicious content could cause Thunderbird to crash or,
potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-2802, CVE-2008-2803) A flaw was found in the way a malformed
.properties file was processed by Thunderbird. A malicious extension could read
uninitialized memory, possibly leaking sensitive data to the extension.
(CVE-2008-2807) A flaw was found in the way Thunderbird displayed information
about self-signed certificates. It was possible for a self-signed certificate to
contain multiple alternate name entries, which were not all displayed to the
user, allowing them to mistakenly extend trust to an unknown site.
(CVE-2008-2809) Thunderbird was updated to upstream version 2.0.0.16 to
address these flaws: http://www.mozilla.org/security/known-
vulnerabilities/thunderbird20.html#thunderbird2.0.0.16

ChangeLog:

* Wed Jul 23 2008 Christopher Aillon 2.0.0.16-1
- Update to 2.0.0.16

References:

[ 1 ] Bug #452598 - CVE-2008-2799 Firefox javascript arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=452598
[ 2 ] Bug #452709 - CVE-2008-2807 Firefox .properties memory leak
https://bugzilla.redhat.com/show_bug.cgi?id=452709
[ 3 ] Bug #452204 - CVE-2008-2785 mozilla: CSS reference counter overflow (ZDI-CAN-349)
https://bugzilla.redhat.com/show_bug.cgi?id=452204
[ 4 ] Bug #452597 - CVE-2008-2798 Firefox malformed web content flaws
https://bugzilla.redhat.com/show_bug.cgi?id=452597
[ 5 ] Bug #452602 - CVE-2008-2803 Firefox javascript arbitrary code execution
https://bugzilla.redhat.com/show_bug.cgi?id=452602
[ 6 ] Bug #453007 - CVE-2008-2811 Firefox block reflow flaw
https://bugzilla.redhat.com/show_bug.cgi?id=453007
[ 7 ] Bug #452600 - CVE-2008-2802 Firefox arbitrary JavaScript code execution
https://bugzilla.redhat.com/show_bug.cgi?id=452600
[ 8 ] Bug #452711 - CVE-2008-2809 Firefox self signed certificate flaw
https://bugzilla.redhat.com/show_bug.cgi?id=452711

Solution: Apply the appropriate updates.

This update can be installed with the yum update program. Use
su -c 'yum update thunderbird' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.

http://www.securityspace.com/smysecure/catid.html?in=FEDORA-2008-6737

Risk factor : Critical

CVSS Score:
10.0

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2008-2785
Bugtraq: 20080717 ZDI-08-044: Mozilla Firefox CSSValue Array Memory Corruption Vulnerability (Google Search)
http://www.securityfocus.com/archive/1/archive/1/494504/100/0/threaded
Bugtraq: 20080729 rPSA-2008-0238-1 firefox (Google Search)
http://www.securityfocus.com/archive/1/archive/1/494860/100/0/threaded
http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30
http://blog.mozilla.com/security/2008/06/18/new-security-issue-under-investigation/
http://www.zerodayinitiative.com/advisories/ZDI-08-044/
Debian Security Information: DSA-1614 (Google Search)
http://www.debian.org/security/2008/dsa-1614
Debian Security Information: DSA-1615 (Google Search)
http://www.debian.org/security/2008/dsa-1615
Debian Security Information: DSA-1621 (Google Search)
http://www.debian.org/security/2008/dsa-1621
Debian Security Information: DSA-1697 (Google Search)
http://www.debian.org/security/2009/dsa-1697
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00667.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00672.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.html
http://security.gentoo.org/glsa/glsa-200808-03.xml
http://www.mandriva.com/security/advisories?name=MDVSA-2008:148
http://www.mandriva.com/security/advisories?name=MDVSA-2008:155
http://www.redhat.com/support/errata/RHSA-2008-0597.html
http://www.redhat.com/support/errata/RHSA-2008-0598.html
http://www.redhat.com/support/errata/RHSA-2008-0599.html
RedHat Security Advisories: RHSA-2008:0616
http://rhn.redhat.com/errata/RHSA-2008-0616.html
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380974
http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.380767
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
http://www.ubuntu.com/usn/usn-623-1
http://www.ubuntu.com/usn/usn-629-1
http://www.ubuntu.com/usn/usn-626-1
http://www.ubuntu.com/usn/usn-626-2
BugTraq ID: 29802
http://www.securityfocus.com/bid/29802
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9900
http://secunia.com/advisories/34501
http://www.vupen.com/english/advisories/2008/1873
http://www.securitytracker.com/id?1020336
http://secunia.com/advisories/30761
http://secunia.com/advisories/31122
http://secunia.com/advisories/31121
http://secunia.com/advisories/31129
http://secunia.com/advisories/31157
http://secunia.com/advisories/31144
http://secunia.com/advisories/31145
http://secunia.com/advisories/31154
http://secunia.com/advisories/31176
http://secunia.com/advisories/31183
http://secunia.com/advisories/31195
http://secunia.com/advisories/31220
http://secunia.com/advisories/31270
http://secunia.com/advisories/31261
http://secunia.com/advisories/31253
http://secunia.com/advisories/31306
http://secunia.com/advisories/31377
http://secunia.com/advisories/31286
http://secunia.com/advisories/31403
http://secunia.com/advisories/33433
http://www.vupen.com/english/advisories/2009/0977
XForce ISS Database: firefox-unspecified-code-execution(43167)
https://exchange.xforce.ibmcloud.com/vulnerabilities/43167
Common Vulnerability Exposure (CVE) ID: CVE-2008-2798
Bugtraq: 20080708 rPSA-2008-0216-1 firefox (Google Search)
http://www.securityfocus.com/archive/1/archive/1/494080/100/0/threaded
Debian Security Information: DSA-1607 (Google Search)
http://www.debian.org/security/2008/dsa-1607
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html
http://www.mandriva.com/security/advisories?name=MDVSA-2008:136
http://www.redhat.com/support/errata/RHSA-2008-0547.html
http://www.redhat.com/support/errata/RHSA-2008-0549.html
http://www.redhat.com/support/errata/RHSA-2008-0569.html
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
SuSE Security Announcement: SUSE-SA:2008:034 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
http://www.ubuntu.com/usn/usn-619-1
BugTraq ID: 30038
http://www.securityfocus.com/bid/30038
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10087
http://secunia.com/advisories/31076
http://www.vupen.com/english/advisories/2008/1993/references
http://www.securitytracker.com/id?1020419
http://secunia.com/advisories/30911
http://secunia.com/advisories/30915
http://secunia.com/advisories/30878
http://secunia.com/advisories/30898
http://secunia.com/advisories/30903
http://secunia.com/advisories/30949
http://secunia.com/advisories/31005
http://secunia.com/advisories/31008
http://secunia.com/advisories/31069
http://secunia.com/advisories/31023
http://secunia.com/advisories/31021
Common Vulnerability Exposure (CVE) ID: CVE-2008-2799
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10743
Common Vulnerability Exposure (CVE) ID: CVE-2008-2811
CERT/CC vulnerability note: VU#607267
http://www.kb.cert.org/vuls/id/607267
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9865
Common Vulnerability Exposure (CVE) ID: CVE-2008-2802
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11121
Common Vulnerability Exposure (CVE) ID: CVE-2008-2803
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10747
Common Vulnerability Exposure (CVE) ID: CVE-2008-2807
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9432
XForce ISS Database: firefox-propertiesfile-info-disclosure(50656)
https://exchange.xforce.ibmcloud.com/vulnerabilities/50656
Common Vulnerability Exposure (CVE) ID: CVE-2008-2809
Bugtraq: 20071118 Certificate spoofing issue with Mozilla, Konqueror, Safari 2 (Google Search)
http://www.securityfocus.com/archive/1/archive/1/483929/100/100/threaded
Bugtraq: 20071118 RE: Certificate spoofing issue with Mozilla, Konqueror, Safari 2 (Google Search)
http://www.securityfocus.com/archive/1/archive/1/483960/100/100/threaded
Bugtraq: 20071118 Re: Certificate spoofing issue with Mozilla, Konqueror, Safari 2 (Google Search)
http://www.securityfocus.com/archive/1/archive/1/483937/100/100/threaded
http://nils.toedtmann.net/pub/subjectAltName.txt
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10205
http://securitytracker.com/id?1018979
http://securityreason.com/securityalert/3498
XForce ISS Database: mozilla-altnames-spoofing(43524)
https://exchange.xforce.ibmcloud.com/vulnerabilities/43524
CopyrightCopyright (c) 2008 E-Soft Inc. http://www.securityspace.com

This is only one of 58962 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe | Whois

© 1998-2018 E-Soft Inc. All rights reserved.