Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237) Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information. (CVE-2008-1234) A flaw was found in the processing of malformed JavaScript content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird.
(CVE-2008-1380) Note: JavaScript support is disabled by default in Thunderbird; the above issue is not exploitable unless JavaScript is enabled. All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Various MozillaThunderbird fixes were backported to the 10.2 version (1.5.0.x).

  + MFSA 2008-15/CVE-2008-1236 and CVE-2008-1237: Crashes     with evidence of memory corruption (rv:1.8.1.13)

  + MFSA 2008-14/CVE-2008-1233, CVE-2008-1234, and     CVE-2008-1235: JavaScript privilege escalation and     arbitrary code execution.

JavaScript is not default enabled in our Thunderbird builds though.

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.16 (CVE-2008-1233, CVE-2008-1234, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237, CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2802, CVE-2008-2803, CVE-2008-2807, CVE-2008-2809, CVE-2008-2811).

This update provides the latest Thunderbird to correct these issues.
It also provides Thunderbird 2.x for Corporate 3.0 systems.

Update :

The previous update provided the incorrect version of the enigmail locale files. This version correctly builds them for Thunderbird 2.0.0.16.

Updated firefox packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Mozilla Firefox is an open source Web browser.

Several flaws were found in the processing of some malformed web content. A web page containing such malicious content could cause Firefox to crash or, potentially, execute arbitrary code as the user running Firefox. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. A web page containing specially crafted content could, potentially, trick a Firefox user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

All Firefox users should upgrade to these updated packages, which contain backported patches that correct these issues.

# This shares a lot of text with dsa-1532.wml, dsa-1535.wml, dsa-1574.wml

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the SeaMonkey Internet Suite.
The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-4879     Peter Brodersen and Alexander Klink discovered that the     autoselection of SSL client certificates could lead to     users being tracked, resulting in a loss of privacy.

  - CVE-2008-1233     'moz_bug_r_a4' discovered that variants of CVE-2007-3738     and CVE-2007-5338 allow the execution of arbitrary code     through XPCNativeWrapper.

  - CVE-2008-1234     'moz_bug_r_a4' discovered that insecure handling of     event handlers could lead to cross-site scripting.

  - CVE-2008-1235     Boris Zbarsky, Johnny Stenback and 'moz_bug_r_a4'     discovered that incorrect principal handling could lead     to cross-site scripting and the execution of arbitrary     code.

  - CVE-2008-1236     Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett     and Mats Palmgren discovered crashes in the layout     engine, which might allow the execution of arbitrary     code.

  - CVE-2008-1237     'georgi', 'tgirmann' and Igor Bukanov discovered crashes     in the JavaScript engine, which might allow the     execution of arbitrary code.

  - CVE-2008-1238     Gregory Fleischer discovered that HTTP Referrer headers     were handled incorrectly in combination with URLs     containing Basic Authentication credentials with empty     usernames, resulting in potential Cross-Site Request     Forgery attacks.

  - CVE-2008-1240     Gregory Fleischer discovered that web content fetched     through the jar: protocol can use Java to connect to     arbitrary ports. This is only an issue in combination     with the non-free Java plugin.

  - CVE-2008-1241     Chris Thomas discovered that background tabs could     generate XUL popups overlaying the current tab,     resulting in potential spoofing attacks.

The Mozilla products from the old stable distribution (sarge) are no longer supported.

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

This update brings Mozilla Firefox to security update version 2.0.0.14

Following security problems were fixed :

  - MFSA 2008-20/CVE-2008-1380: Fixes for security problems     in the JavaScript engine described in MFSA 2008-15     (CVE-2008-1237) introduced a stability problem, where     some users experienced frequent crashes during     JavaScript garbage collection. These crashes may be     exploitable if someone finds a reliable way to trigger     the crash.

From Red Hat Security Advisory 2008:0209 :

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. (CVE-2008-1233, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237)

Several flaws were found in the display of malformed web content. An HTML mail message containing specially crafted content could, potentially, trick a user into surrendering sensitive information.
(CVE-2008-1234, CVE-2008-1238, CVE-2008-1241)

Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled.

All Thunderbird users should upgrade to these updated packages, which contain backported patches to resolve these issues.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.13.

This update provides the latest Firefox to correct these issues.

# This shares a lot of text with dsa-1532.wml, dsa-1534.wml, dsa-1535.wml

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird client. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-1233     'moz_bug_r_a4' discovered that variants of CVE-2007-3738     and CVE-2007-5338 allow the execution of arbitrary code     through XPCNativeWrapper.

  - CVE-2008-1234     'moz_bug_r_a4' discovered that insecure handling of     event handlers could lead to cross-site scripting.

  - CVE-2008-1235     Boris Zbarsky, Johnny Stenback and 'moz_bug_r_a4'     discovered that incorrect principal handling could lead     to cross-site scripting and the execution of arbitrary     code.

  - CVE-2008-1236     Tom Ferris, Seth Spitzer, Martin Wargers, John Daggett     and Mats Palmgren discovered crashes in the layout     engine, which might allow the execution of arbitrary     code.

  - CVE-2008-1237     'georgi', 'tgirmann' and Igor Bukanov discovered crashes     in the JavaScript engine, which might allow the     execution of arbitrary code.

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues, including crashes that can corrupt memory, as well as a JavaScript privilege escalation and arbitrary code execution flaw.

ID	名稱	產品	系列	已發布	已更新	嚴重性
32206	Fedora 8 : thunderbird-2.0.0.14-1.fc8 (2008-3557)	Nessus	Fedora Local Security Checks	2008/5/11	2021/1/11	high
33120	openSUSE 10 Security Update : MozillaThunderbird (MozillaThunderbird-5329)	Nessus	SuSE Local Security Checks	2008/6/9	2021/1/14	high
60380	Scientific Linux Security Update : thunderbird on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
36242	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2008:155-1)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	critical
31684	CentOS 4 / 5 : firefox (CESA-2008:0207)	Nessus	CentOS Local Security Checks	2008/3/28	2021/1/4	high
31711	Debian DSA-1534-1 : iceape - several vulnerabilities	Nessus	Debian Local Security Checks	2008/3/31	2021/1/4	high
31757	RHEL 4 / 5 : thunderbird (RHSA-2008:0209)	Nessus	Red Hat Local Security Checks	2008/4/4	2021/1/14	high
32114	openSUSE 10 Security Update : MozillaFirefox (MozillaFirefox-5219)	Nessus	SuSE Local Security Checks	2008/5/1	2021/1/14	high
67677	Oracle Linux 4 : thunderbird (ELSA-2008-0209)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
36441	Mandriva Linux Security Advisory : mozilla-firefox (MDVSA-2008:080)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	high
32308	Debian DSA-1574-1 : icedove - several vulnerabilities	Nessus	Debian Local Security Checks	2008/5/13	2021/1/4	high
32445	Slackware 10.2 / 11.0 / 12.0 / 12.1 / current : mozilla-thunderbird (SSA:2008-128-02)	Nessus	Slackware Local Security Checks	2008/5/28	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

critical

high

high

high

high

high

high

high

high