- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
Gentoo Linux Security Advisory
GLSA 200608-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
http://security.gentoo.or
g/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
Severity: Normal
Title: Mozilla Thunderbird: Multiple vulnerabilities
Date: August 03, 2006
Bugs: #141842
ID: 200608-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
Synopsis
========
The Mozilla Foundation has reported numerous security
vulnerabilities
related to Mozilla Thunderbird.
Background
==========
The Mozilla Thunderbird mail client is a redesign of the
Mozilla Mail
component. The goal is to produce a cross-platform
stand-alone mail
application using XUL (XML User Interface Language).
Affected packages
=================
------------------------------------------------------------
-------
Package / Vulnerable /
Unaffected
------------------------------------------------------------
-------
1 mozilla-thunderbird < 1.5.0.5
>= 1.5.0.5
2 mozilla-thunderbird-bin < 1.5.0.5
>= 1.5.0.5
------------------------------------------------------------
-------
2 affected packages on all of their supported
architectures.
------------------------------------------------------------
-------
Description
===========
The following vulnerabilities have been reported:
* Benjamin Smedberg discovered that chrome URLss could be
made to
reference remote files.
* Developers in the Mozilla community looked for and fixed
several
crash bugs to improve the stability of Mozilla clients.
* "shutdown" reports that cross-site scripting
(XSS) attacks could be
performed using the construct
XPCNativeWrapper(window).Function(...),
which created a function that appeared to belong to the
window in
question even after it had been navigated to the target
site.
* "shutdown" reports that scripts granting the
UniversalBrowserRead
privilege can leverage that into the equivalent of the far
more
powerful UniversalXPConnect since they are allowed to
"read" into a
privileged context.
* "moz_bug_r_a4" discovered that Named
JavaScript functions have a
parent object created using the standard Object()
constructor
(ECMA-specified behavior) and that this constructor can be
redefined
by script (also ECMA-specified behavior).
* Igor Bukanov and shutdown found additional places where an
untimely
garbage collection could delete a temporary object that
was in active
use.
* Georgi Guninski found potential integer overflow issues
with long
strings in the toSource() methods of the Object, Array and
String
objects as well as string function arguments.
* H. D. Moore reported a testcase that was able to trigger a
race
condition where JavaScript garbage collection deleted a
temporary
variable still being used in the creation of a new
Function object.
* A malicious page can hijack native DOM methods on a
document object
in another domain, which will run the attacker's script
when called
by the victim page.
* Secunia Research has discovered a vulnerability which is
caused due
to an memory corruption error within the handling of
simultaneously
happening XPCOM events. This leads to use of a deleted
timer object.
Impact
======
A user can be enticed to open specially crafted URLs, visit
webpages
containing malicious JavaScript or execute a specially
crafted script.
These events could lead to the execution of arbitrary code,
or the
installation of malware on the user's computer.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Mozilla Thunderbird users should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=mail-client/mozilla-thunderbird-1.5.0.5"
All Mozilla Thunderbird binary users should upgrade to the
latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose
">=mail-client/mozilla-thunderbird-bin-1.5.0.5&quo
t;
References
==========
[ 1 ] CVE-2006-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3113
[ 2 ] CVE-2006-3802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3802
[ 3 ] CVE-2006-3803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3803
[ 4 ] CVE-2006-3804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3804
[ 5 ] CVE-2006-3805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3805
[ 6 ] CVE-2006-3806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3806
[ 7 ] CVE-2006-3807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3807
[ 8 ] CVE-2006-3809
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3809
[ 9 ] CVE-2006-3810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3810
[ 10 ] CVE-2006-3811
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3811
[ 11 ] CVE-2006-3812
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
6-3812
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
ht
tp://security.gentoo.org/glsa/glsa-200608-04.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of
utmost
importance to us. Any security concerns should be addressed
to
security gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://
creativecommons.org/licenses/by-sa/2.5
|