Debian: DSA-1830-1: New icedove packages fix several vulnerabilities

    Date12 Jul 2009
    CategoryDebian
    38
    Posted ByLinuxSecurity Advisories
    Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1830-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                      Steffen Joeris
    July 12, 2009                         http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : icedove                                                                                                                                                        
    Vulnerability  : several vulnerabilities                                                                                                                                        
    Problem type   : remote                                                                                                                                                         
    Debian-specific: no                                                                                                                                                             
    CVE IDs        : CVE-2009-0040 CVE-2009-0352 CVE-2009-0353 CVE-2009-0652                                                                                                        
    CVE-2009-0771 CVE-2009-0772 CVE-2009-0773 CVE-2009-0774 CVE-2009-0776                                                                                                           
    CVE-2009-1302 CVE-2009-1303 CVE-2009-1307 CVE-2009-1832 CVE-2009-1392                                                                                                           
    CVE-2009-1836 CVE-2009-1838 CVE-2009-1841                                                                                                                                       
    
    
    Several remote vulnerabilities have been discovered in the Icedove
    mail client, an unbranded version of the Thunderbird mail client. The
    Common Vulnerabilities and Exposures project identifies the following
    problems:                                                            
    
    CVE-2009-0040
    
    The execution of arbitrary code might be possible via a crafted PNG file
    that triggers a free of an uninitialized pointer in (1) the png_read_png
    function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables. 
    (MFSA 2009-10)                                                          
    
    CVE-2009-0352
    
    It is possible to execute arbitrary code via vectors related to the
    layout engine. (MFSA 2009-01)                                      
    
    CVE-2009-0353
    
    It is possible to execute arbitrary code via vectors related to the
    JavaScript engine. (MFSA 2009-01)                                  
    
    CVE-2009-0652
    
    Bjoern Hoehrmann and Moxie Marlinspike discovered a possible spoofing
    attack via Unicode box drawing characters in internationalized domain
    names. (MFSA 2009-15)                                                
    
    CVE-2009-0771
    
    Memory corruption and assertion failures have been discovered in the
    layout engine, leading to the possible execution of arbitrary code. 
    (MFSA 2009-07)                                                      
    
    CVE-2009-0772
    
    The layout engine allows the execution of arbitrary code ia vectors
    related to nsCSSStyleSheet::GetOwnerNode, events, and garbage      
    collection. (MFSA 2009-07)                                         
    
    CVE-2009-0773
    
    The JavaScript engine is prone to the execution of arbitrary code via
    several vectors. (MFSA 2009-07)                                      
    
    CVE-2009-0774
    
    The layout engine allows the execution of arbitrary code via vectors
    related to gczeal. (MFSA 2009-07)                                   
    
    CVE-2009-0776
    
    Georgi Guninski discovered that it is possible to obtain xml data via
    an issue related to the nsIRDFService. (MFSA 2009-09)                
    
    CVE-2009-1302
    
    The browser engine is prone to a possible memory corruption via several
    vectors. (MFSA 2009-14)                                                
    
    CVE-2009-1303
    
    The browser engine is prone to a possible memory corruption via the
    nsSVGElement::BindToTree function. (MFSA 2009-14)                  
    
    CVE-2009-1307
    
    Gregory Fleischer discovered that it is possible to bypass the Same
    Origin Policy when opening a Flash file via the view-source: scheme.
    (MFSA 2009-17)                                                      
    
    CVE-2009-1832
    
    The possible arbitrary execution of code was discovered via vectors
    involving "double frame construction." (MFSA 2009-24)              
    
    CVE-2009-1392
    
    Several issues were discovered in the browser engine as used by icedove,
    which could lead to the possible execution of arbitrary code.           
    (MFSA 2009-24)                                                          
    
    CVE-2009-1836
    
    Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang reported a potential
    man-in-the-middle attack, when using a proxy due to insufficient checks
    on a certain proxy response. (MFSA 2009-27)
    
    CVE-2009-1838
    
    moz_bug_r_a4 discovered that it is possible to execute arbitrary
    JavaScript with chrome privileges due to an error in the
    garbage-collection implementation. (MFSA 2009-29)
    
    CVE-2009-1841
    
    moz_bug_r_a4 reported that it is possible for scripts from page content
    to run with elevated privileges and thus potentially executing arbitrary
    code with the object's chrome privileges. (MFSA 2009-32)
    
    No CVE id yet
    
    Bernd Jendrissek discovered a potentially exploitable crash when viewing
    a multipart/alternative mail message with a text/enhanced part.
    (MFSA 2009-33)
    
    
    For the stable distribution (lenny), these problems have been fixed in
    version 2.0.0.22-0lenny1.
    
    As indicated in the Etch release notes, security support for the
    Mozilla products in the oldstable distribution needed to be stopped
    before the end of the regular Etch security maintenance life cycle.
    You are strongly encouraged to upgrade to stable or switch to a still
    supported mail client.
    
    For the testing (squeeze) distribution these problems will be fixed soon.
    
    For the unstable distribution (sid), these problems have been fixed in
    version 2.0.0.22-1.
    
    
    We recommend that you upgrade your icedove packages.
    
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1.dsc
        Size/MD5 checksum:     1667 e373157340de8a93d36e6210afe2f345
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1.diff.gz
        Size/MD5 checksum:   118782 0f1d8098818180a72820438adfa79436
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22.orig.tar.gz
        Size/MD5 checksum: 36965969 8e0ffafaece0680a42c0cb11ff34c64a
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_alpha.deb
        Size/MD5 checksum: 13441166 eb9f665e0e18b36daf2542288567bc0e
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_alpha.deb
        Size/MD5 checksum: 57359422 0e1af2a3bfd6d7f1d66840a9d9bbdc3c
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_alpha.deb
        Size/MD5 checksum:    60844 e782984c2808227c747a7930c70455d5
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_alpha.deb
        Size/MD5 checksum:  3723116 f35a203a81b097f19d67a454df6eae3f
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_amd64.deb
        Size/MD5 checksum: 57569412 b76a17f1fd3c76328802ffe5b5210d29
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_amd64.deb
        Size/MD5 checksum: 12338088 bae6d2708c11bcb1fd169005ff561b14
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_amd64.deb
        Size/MD5 checksum:    58854 28bef0b2e39a58e5a53fcabce5d02444
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_amd64.deb
        Size/MD5 checksum:  3704724 bb42d33cac6a532dcfd348f2909a7a1f
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_arm.deb
        Size/MD5 checksum: 10924558 a6377d02484cdf7c832ea949e17b0b5b
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_arm.deb
        Size/MD5 checksum: 56478312 4a80f7a148b3c95a6e70e493972d4689
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_arm.deb
        Size/MD5 checksum:    53392 d7c8ba83bd82e3e37902881056d5cc19
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_arm.deb
        Size/MD5 checksum:  3929498 9c800bff03993a158efc6b686d1808eb
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_hppa.deb
        Size/MD5 checksum: 13934564 5f5d936cead750583036c15e4f12ee84
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_hppa.deb
        Size/MD5 checksum: 58508036 47a7976a3e62a96b0a30ba308828ceca
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_hppa.deb
        Size/MD5 checksum:    60260 43957fc0f5fd4164b68dc569553fcd0d
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_hppa.deb
        Size/MD5 checksum:  3944546 4e30f36cd2bbbcdd74213392116ddad5
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_i386.deb
        Size/MD5 checksum:  3934604 336b57d8a95a52cffc2c07b5ed605c74
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_i386.deb
        Size/MD5 checksum: 10924508 b4cf9766cac84f9d21defc2ea4e1d1bc
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
        Size/MD5 checksum:    54082 86ac55697cfc6abc6a719be26c5fcb48
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_i386.deb
        Size/MD5 checksum: 56523330 8f925c6cea9ec7e628e05a8079dd30ad
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_ia64.deb
        Size/MD5 checksum: 16521158 4271ac14c8b4bc91d606cc2848d32a59
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_ia64.deb
        Size/MD5 checksum:    66018 4659cf77ec8dc16df43dc17f9fafd30b
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_ia64.deb
        Size/MD5 checksum:  3756644 ffe54230f44502f546db8cabf5f90c8b
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_ia64.deb
        Size/MD5 checksum: 57191766 fd750b5ec53e9b271e6a9a6b6a8c7592
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_mips.deb
        Size/MD5 checksum: 59425636 e903cd19e5c016e0a8b2fb7b152db5ec
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_mips.deb
        Size/MD5 checksum:    56028 e1d9c13acc9d8e251221b14c930b5172
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_mips.deb
        Size/MD5 checksum: 11674728 83b91e8518ee428dc6d7cb9566ba54ff
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_mips.deb
        Size/MD5 checksum:  3707428 18ab15666626952530e1819732475f96
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_mipsel.deb
        Size/MD5 checksum:    55732 c368bc2d18dac3ec865d83b1677efcca
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_mipsel.deb
        Size/MD5 checksum:  3707400 03ba8ac5d466bed85ac96ec188a3ec61
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_mipsel.deb
        Size/MD5 checksum: 11438296 2b7ea15c0e698b5a5cdc7445cfbecb66
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_mipsel.deb
        Size/MD5 checksum: 57501964 9c22fe40c2154e7714b4c852751265bd
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_powerpc.deb
        Size/MD5 checksum:  3708088 fe79a3b35ecdcf87602f4dc69e568afd
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_powerpc.deb
        Size/MD5 checksum:    57232 1e65aee9e96495ae8191d6442b17f96d
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_powerpc.deb
        Size/MD5 checksum: 59499604 27e7f1250d8e1ae86a2db606dbecb42d
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_powerpc.deb
        Size/MD5 checksum: 12062484 3f15804556ea0aa9de21177937be0f71
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_s390.deb
        Size/MD5 checksum: 12795730 bea3550a60db31c288ee9f7acc1dbe56
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_s390.deb
        Size/MD5 checksum: 58573916 62b1aed5e834bf7140649525d3431ba9
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_s390.deb
        Size/MD5 checksum:  3707716 e12ede189e11a59e5c9a9bd689038ca1
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_s390.deb
        Size/MD5 checksum:    59444 e3ebdc37058c6da4039e6994afefab33
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_sparc.deb
        Size/MD5 checksum: 56338680 b95f62bf55eb01eb0339ff5ac7ae680f
      http://security.debian.org/pool/updates/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_sparc.deb
        Size/MD5 checksum:    53890 043f1ac4e04a1eda27186a9c282baa15
      http://security.debian.org/pool/updates/main/i/icedove/icedove_2.0.0.22-0lenny1_sparc.deb
        Size/MD5 checksum: 11083222 2a3c3d75b1273a1dcdd391b28cec1d75
      http://security.debian.org/pool/updates/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_sparc.deb
        Size/MD5 checksum:  3688958 ec9cbf4f683c04496efa8d8089cb72e9
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.