1 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
2 |
Gentoo Linux Security Advisory GLSA 200608-04 |
3 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
4 |
http://security.gentoo.org/ |
5 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
6 |
|
7 |
Severity: Normal |
8 |
Title: Mozilla Thunderbird: Multiple vulnerabilities |
9 |
Date: August 03, 2006 |
10 |
Bugs: #141842 |
11 |
ID: 200608-04 |
12 |
|
13 |
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - |
14 |
|
15 |
Synopsis |
16 |
======== |
17 |
|
18 |
The Mozilla Foundation has reported numerous security vulnerabilities |
19 |
related to Mozilla Thunderbird. |
20 |
|
21 |
Background |
22 |
========== |
23 |
|
24 |
The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail |
25 |
component. The goal is to produce a cross-platform stand-alone mail |
26 |
application using XUL (XML User Interface Language). |
27 |
|
28 |
Affected packages |
29 |
================= |
30 |
|
31 |
------------------------------------------------------------------- |
32 |
Package / Vulnerable / Unaffected |
33 |
------------------------------------------------------------------- |
34 |
1 mozilla-thunderbird < 1.5.0.5 >= 1.5.0.5 |
35 |
2 mozilla-thunderbird-bin < 1.5.0.5 >= 1.5.0.5 |
36 |
------------------------------------------------------------------- |
37 |
2 affected packages on all of their supported architectures. |
38 |
------------------------------------------------------------------- |
39 |
|
40 |
Description |
41 |
=========== |
42 |
|
43 |
The following vulnerabilities have been reported: |
44 |
|
45 |
* Benjamin Smedberg discovered that chrome URLss could be made to |
46 |
reference remote files. |
47 |
|
48 |
* Developers in the Mozilla community looked for and fixed several |
49 |
crash bugs to improve the stability of Mozilla clients. |
50 |
|
51 |
* "shutdown" reports that cross-site scripting (XSS) attacks could be |
52 |
performed using the construct XPCNativeWrapper(window).Function(...), |
53 |
which created a function that appeared to belong to the window in |
54 |
question even after it had been navigated to the target site. |
55 |
|
56 |
* "shutdown" reports that scripts granting the UniversalBrowserRead |
57 |
privilege can leverage that into the equivalent of the far more |
58 |
powerful UniversalXPConnect since they are allowed to "read" into a |
59 |
privileged context. |
60 |
|
61 |
* "moz_bug_r_a4" discovered that Named JavaScript functions have a |
62 |
parent object created using the standard Object() constructor |
63 |
(ECMA-specified behavior) and that this constructor can be redefined |
64 |
by script (also ECMA-specified behavior). |
65 |
|
66 |
* Igor Bukanov and shutdown found additional places where an untimely |
67 |
garbage collection could delete a temporary object that was in active |
68 |
use. |
69 |
|
70 |
* Georgi Guninski found potential integer overflow issues with long |
71 |
strings in the toSource() methods of the Object, Array and String |
72 |
objects as well as string function arguments. |
73 |
|
74 |
* H. D. Moore reported a testcase that was able to trigger a race |
75 |
condition where JavaScript garbage collection deleted a temporary |
76 |
variable still being used in the creation of a new Function object. |
77 |
|
78 |
* A malicious page can hijack native DOM methods on a document object |
79 |
in another domain, which will run the attacker's script when called |
80 |
by the victim page. |
81 |
|
82 |
* Secunia Research has discovered a vulnerability which is caused due |
83 |
to an memory corruption error within the handling of simultaneously |
84 |
happening XPCOM events. This leads to use of a deleted timer object. |
85 |
|
86 |
Impact |
87 |
====== |
88 |
|
89 |
A user can be enticed to open specially crafted URLs, visit webpages |
90 |
containing malicious JavaScript or execute a specially crafted script. |
91 |
These events could lead to the execution of arbitrary code, or the |
92 |
installation of malware on the user's computer. |
93 |
|
94 |
Workaround |
95 |
========== |
96 |
|
97 |
There is no known workaround at this time. |
98 |
|
99 |
Resolution |
100 |
========== |
101 |
|
102 |
All Mozilla Thunderbird users should upgrade to the latest version: |
103 |
|
104 |
# emerge --sync |
105 |
# emerge --ask --oneshot --verbose |
106 |
">=mail-client/mozilla-thunderbird-1.5.0.5" |
107 |
|
108 |
All Mozilla Thunderbird binary users should upgrade to the latest |
109 |
version: |
110 |
|
111 |
# emerge --sync |
112 |
# emerge --ask --oneshot --verbose |
113 |
">=mail-client/mozilla-thunderbird-bin-1.5.0.5" |
114 |
|
115 |
References |
116 |
========== |
117 |
|
118 |
[ 1 ] CVE-2006-3113 |
119 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113 |
120 |
[ 2 ] CVE-2006-3802 |
121 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802 |
122 |
[ 3 ] CVE-2006-3803 |
123 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803 |
124 |
[ 4 ] CVE-2006-3804 |
125 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804 |
126 |
[ 5 ] CVE-2006-3805 |
127 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805 |
128 |
[ 6 ] CVE-2006-3806 |
129 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806 |
130 |
[ 7 ] CVE-2006-3807 |
131 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807 |
132 |
[ 8 ] CVE-2006-3809 |
133 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809 |
134 |
[ 9 ] CVE-2006-3810 |
135 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810 |
136 |
[ 10 ] CVE-2006-3811 |
137 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811 |
138 |
[ 11 ] CVE-2006-3812 |
139 |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812 |
140 |
|
141 |
Availability |
142 |
============ |
143 |
|
144 |
This GLSA and any updates to it are available for viewing at |
145 |
the Gentoo Security Website: |
146 |
|
147 |
http://security.gentoo.org/glsa/glsa-200608-04.xml |
148 |
|
149 |
Concerns? |
150 |
========= |
151 |
|
152 |
Security is a primary focus of Gentoo Linux and ensuring the |
153 |
confidentiality and security of our users machines is of utmost |
154 |
importance to us. Any security concerns should be addressed to |
155 |
security@g.o or alternatively, you may file a bug at |
156 |
http://bugs.gentoo.org. |
157 |
|
158 |
License |
159 |
======= |
160 |
|
161 |
Copyright 2006 Gentoo Foundation, Inc; referenced text |
162 |
belongs to its owner(s). |
163 |
|
164 |
The contents of this document are licensed under the |
165 |
Creative Commons - Attribution / Share Alike license. |
166 |
|
167 |
http://creativecommons.org/licenses/by-sa/2.5 |