| Summary: | Thunderbird 10.0.8 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | |
| Severity: | critical | ||
| Priority: | Normal | CC: | davidwhodgins, fundawang, lemonzest, sysadmin-bugs, tmb |
| Version: | 2 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/519136/ | ||
| Whiteboard: | MGA1TOO MGA2-64-OK MGA2-32-OK MGA1-64-OK MGA1-32-OK | ||
| Source RPM: | thunderbird-10.0.7-1.mga1.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2012-10-10 03:59:35 CEST
David Walser
2012-10-10 03:59:51 CEST
CC:
(none) =>
fundawang All my extensions are working, and I can also still Sign emails with Enigmail. Works same as previous version. CC:
(none) =>
lemonzest Forgot to add, Mageia 2, x86_64
David Walser
2012-10-10 23:51:59 CEST
URL:
(none) =>
http://lwn.net/Vulnerabilities/519136/ Testing complete using nntp, email, with enigmail Mageia 1 and 2, i586 and x86-64. Could someone from the sysadmin team push the srpms thunderbird-10.0.8-1.mga2.src.rpm thunderbird-l10n-10.0.8-1.mga2.src.rpm from Mageia 2 Core Updates Testing to Core Updates and the srpms mozilla-thunderbird-10.0.8-1.mga1.src.rpm mozilla-thunderbird-l10n-10.0.8-1.mga1.src.rpm from Mageia 1 Core Updates Testing to Core Updates. Advisory: Updated mozilla-thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2012-3982, CVE-2012-3988, CVE-2012-3990, CVE-2012-3995, CVE-2012-4179, CVE-2012-4180, CVE-2012-4181, CVE-2012-4182, CVE-2012-4183, CVE-2012-4185, CVE-2012-4186, CVE-2012-4187, CVE-2012-4188). Two flaws in Thunderbird could allow malicious content to bypass intended restrictions, possibly leading to information disclosure, or Thunderbird executing arbitrary code. Note that the information disclosure issue could possibly be combined with other flaws to achieve arbitrary code execution (CVE-2012-3986, CVE-2012-3991). Multiple flaws were found in the location object implementation in Thunderbird. Malicious content could be used to perform cross-site scripting attacks, script injection, or spoofing attacks (CVE-2012-1956, CVE-2012-3992, CVE-2012-3994). Two flaws were found in the way Chrome Object Wrappers were implemented. Malicious content could be used to perform cross-site scripting attacks or cause Thunderbird to execute arbitrary code (CVE-2012-3993, CVE-2012-4184). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1956 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3982 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3986 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3988 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3990 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3991 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3992 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3993 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3994 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3995 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4179 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4180 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4181 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4182 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4183 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4184 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4186 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4188 http://www.mozilla.org/security/announce/2012/mfsa2012-59.html http://www.mozilla.org/security/announce/2012/mfsa2012-74.html http://www.mozilla.org/security/announce/2012/mfsa2012-77.html http://www.mozilla.org/security/announce/2012/mfsa2012-79.html http://www.mozilla.org/security/announce/2012/mfsa2012-81.html http://www.mozilla.org/security/announce/2012/mfsa2012-82.html http://www.mozilla.org/security/announce/2012/mfsa2012-83.html http://www.mozilla.org/security/announce/2012/mfsa2012-84.html http://www.mozilla.org/security/announce/2012/mfsa2012-85.html http://www.mozilla.org/security/announce/2012/mfsa2012-86.html http://www.mozilla.org/security/announce/2012/mfsa2012-87.html https://rhn.redhat.com/errata/RHSA-2012-1351.html https://bugs.mageia.org/show_bug.cgi?id=7753 Keywords:
(none) =>
validated_update Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0289 Status:
NEW =>
RESOLVED |