Date: Wed, 20 Jun 2007 11:49:51 -0400
From: Foresight Linux Essential Announcement Service <foresight-security-noreply@foresightlinux.org.>
To: foresight-security-announce@lists.rpath.org
Subject: FLEA-2007-0027-1: thunderbird
Message-ID: <46794c9f.NN+BwssrHMJMnr02%foresight-security-noreply@foresightlinux.org>
User-Agent: Heirloom mailx 12.2 01/07/07
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Foresight Linux Essential Advisory: 2007-0027-1
Published: 2007-06-20
Rating: Major
Updated Versions:
thunderbird=/conary.rpath.com@rpl:devel//foresight.rpath.org@fl:1-devel//1/2.0.0.4-0.1-1
group-dist=/foresight.rpath.org@fl:1-devel//1/1.3-0.6-5
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2867http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2868http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558
https://issues.rpath.com/browse/RPL-1425
Description:
Previous versions of the thunderbird package are vulnerable to multiple
vulnerabilities in the layout and javascript engines which are known to
cause a denial-of-service (crash) and could potentially be exploited to
execute arbitrary attacker-provided code. In addition, a man-in-the-middle
attack which could be used to steal the first 3 characters of a passphrase
when using APOP has been fixed.
- ---
Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License.
A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)
iQIVAwUBRnlMkdfwEn07iAtZAQLXaRAAxjFW1+ns4U7DnZERyAdyWFVMILwe3aGW
TjZzpo9SR1T3cGXTCxRgLci/cmS/mHi1Pob7IDXau2/45rYe32AKMf+4hKOyaOyR
Aqc6EmZfYa4smBTtULJiFVPvEmeZU+wBk481XZyjOuug/iCa0oRdo+z6sG5doLXZ
c57jAeoZm+DNrXV1Q3DVL/rE2TLd5KIjctxLysgBrnzdLw5wdv7xSho6+NJjGXe0
LqPY7BPdoAiMLUGTFc/BWAv0YZ1L7k60QpexRlgVvXAJLiirElKCDe0KYv9jIFxb
TJRHrNKAWafyHThYRnKzf/qC2yLy1qBqfbnnwTtJjhAHO/FbpHsMYBeU1H+gFeJM
f8cOEJCpypax85lQkFK9uB+WkeNN04gM+zZHzdiwBfhAJnDOAbL19C/W/EHvhmjM
NMDnPtIsU7xsLo4W8GhZkq8MZ3pULiVK+fdm2VnqQ8keuTCj5e7hp8ra3aKtuF1C
JCISzrrTvw1FC+g1D1HxoUun6/zkGx2zIPPzkK4MBH5kwAvqADhfCx5hqTJrmGri
ET5S0n1UqrJ8rSa8Mmb/mHGaSPPRRE/h10fKkZWgknbjhQpLDTsPGWLMN15GtdyC
6lMX4ykpcUXdUBWop7HVerPk2x3i91VGS0ymPHLana5CKw3fZFpAmGyQzgKdctks
yXSZXBFca08=
=CjxU
-----END PGP SIGNATURE-----
