Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

Red Hat 4: RHSA-2012:0084-01 Critical: Seamonkey Information Exposure

red hat
Calendar Grey February 1, 2012
Scroller Redhat Esm H88
Essential seamonkey security patch for Fedora, targeting dual significant vulnerabilities that compromise both operating system stability and user confidentiality.
Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4

Solution

Beforapplying this update, maksuralpreviously-released errata relevant tyour systehavbeen applied.

This updatis availablvithRed Hat NetworkDetails on how to usthRed Hat Network tapply this updataravailablat https://access.redhat.com/kb/docs/DOC-11259

Summary

SeaMonkey is an open sourcweb browser, e-maiand newsgrouclient, IRC chat client, and HTML editor.
A flaw was found in thprocessing of malformed web contentA web page containing malicious content could causSeaMonkey tcrash or, potentially, executarbitrary codwith thprivileges of thuser running SeaMonkey(CVE-2012-0442)
Thsame-origin policy in SeaMonkey treated and as interchangeableA malicious script could possibly usthis flaw tgain access tsensitivinformation (such as client's IP and user e-maiaddress, or httpOnly cookies) that may bincluded in HTTP proxy error replies, generated in responstinvalid URLs using squarbrackets(CVE-2011-3670)
AlSeaMonkey users should upgradtthesupdated packages, which correct thesissuesAfter installing thupdate, SeaMonkey must brestarted for thchanges ttakeffect.

Topics%20covered

Topics Covered

security advisory security update red hat critical cross-site scripting information exposure seamonkey

References

https://access.redhat.com/security/cve/CVE-2011-3670 https://access.redhat.com/security/cve/CVE-2012-0442 https://access.redhat.com/security/updates/classification#critical

Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2012:0084-01
Product: Red Hat EnterprisLinux
Advisory URL: https://access.redhat.com/errata/RHSA-2012:0084.html
Issudate: 2012-02-01

Topic

Updated seamonkey packages that fitwsecurity issues arnow availablefor Red Hat EnterprisLinu4.ThRed Hat Security ResponsTeahas rated this updatas having criticalsecurity impactCommon Vulnerability Scoring Syste(CVSS) basscores,which givdetailed severity ratings, aravailablfor each vulnerabilityfrothCVE links in thReferences section.

Topics%20covered

Topics Covered

security advisory security update red hat critical cross-site scripting information exposure seamonkey

Relevant Releases Architectures

Red Hat EnterprisLinuAS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat EnterprisLinuDesktoversion 4 - i386, x86_64

Red Hat EnterprisLinuES version 4 - i386, ia64, x86_64

Red Hat EnterprisLinuWS version 4 - i386, ia64, x86_64

Bugs Fixed

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)

785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-likhostnamsynta(MFSA 2012-02)

6PackagList:

Red Hat EnterprisLinuAS version 4:

Source:

i386:

seamonkey-1.0.9-78.el4.i386.rpm

seamonkey-chat-1.0.9-78.el4.i386.rpm

seamonkey-debuginfo-1.0.9-78.el4.i386.rpm

seamonkey-devel-1.0.9-78.el4.i386.rpm

seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm

seamonkey-js-debugger-1.0.9-78.el4.i386.rpm

seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:

seamonkey-1.0.9-78.el4.ia64.rpm

seamonkey-chat-1.0.9-78.el4.ia64.rpm

seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm

seamonkey-devel-1.0.9-78.el4.ia64.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm

seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm

seamonkey-mail-1.0.9-78.el4.ia64.rpm

ppc:

seamonkey-1.0.9-78.el4.ppc.rpm

seamonkey-chat-1.0.9-78.el4.ppc.rpm

seamonkey-debuginfo-1.0.9-78.el4.ppc.rpm

seamonkey-devel-1.0.9-78.el4.ppc.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ppc.rpm

seamonkey-js-debugger-1.0.9-78.el4.ppc.rpm

seamonkey-mail-1.0.9-78.el4.ppc.rpm

s390:

seamonkey-1.0.9-78.el4.s390.rpm

seamonkey-chat-1.0.9-78.el4.s390.rpm

seamonkey-debuginfo-1.0.9-78.el4.s390.rpm

seamonkey-devel-1.0.9-78.el4.s390.rpm

seamonkey-dom-inspector-1.0.9-78.el4.s390.rpm

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.