Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Red Hat 4: RHSA-2012:0084-01 Critical: Seamonkey Information Exposure

Calendar Feb 01, 2012 • User Avatar LinuxSecurity Advisories
4 - 7 min read
Redhat Large Esm H500
Topics%20covered

Topics Covered

security advisory security update red hat critical cross-site scripting information exposure seamonkey
Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical [More...] 
====================================================================                   Red Hat Security Advisory

Synopsis:          Critical: seamonkey security update
Advisory ID:       RHSA-2012:0084-01
Product:           Red Hat EnterprisLinux
Advisory URL:      https://access.redhat.com/errata/RHSA-2012:0084.html
Issudate:        2012-02-01
CVE Names:         CVE-2011-3670 CVE-2012-0442 
====================================================================
1Summary:

Updated seamonkey packages that fitwsecurity issues arnow available
for Red Hat EnterprisLinu4.

ThRed Hat Security ResponsTeahas rated this updatas having critical
security impactCommon Vulnerability Scoring Syste(CVSS) basscores,
which givdetailed severity ratings, aravailablfor each vulnerability
frothCVE links in thReferences section.

2Relevant releases/architectures:

Red Hat EnterprisLinuAS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat EnterprisLinuDesktoversion 4 - i386, x86_64
Red Hat EnterprisLinuES version 4 - i386, ia64, x86_64
Red Hat EnterprisLinuWS version 4 - i386, ia64, x86_64

3Description:

SeaMonkey is an open sourcweb browser, e-maiand newsgrouclient, IRC
chat client, and HTML editor.

A flaw was found in thprocessing of malformed web contentA web page
containing malicious content could causSeaMonkey tcrash or,
potentially, executarbitrary codwith thprivileges of thuser running
SeaMonkey(CVE-2012-0442)

Thsame-origin policy in SeaMonkey treated and
 as interchangeableA malicious script could possibly
usthis flaw tgain access tsensitivinformation (such as client's
IP and user e-maiaddress, or httpOnly cookies) that may bincluded in
HTTP proxy error replies, generated in responstinvalid URLs using
squarbrackets(CVE-2011-3670)

AlSeaMonkey users should upgradtthesupdated packages, which correct
thesissuesAfter installing thupdate, SeaMonkey must brestarted for
thchanges ttakeffect.

4Solution:

Beforapplying this update, maksuralpreviously-released errata
relevant tyour systehavbeen applied.

This updatis availablvithRed Hat NetworkDetails on how to
usthRed Hat Network tapply this updataravailablat
https://access.redhat.com/kb/docs/DOC-11259

5Bugs fixed (http://bugzilla.redhat.com/):

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-likhostnamsynta(MFSA 2012-02)

6PackagList:

Red Hat EnterprisLinuAS version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

ppc:
seamonkey-1.0.9-78.el4.ppc.rpm
seamonkey-chat-1.0.9-78.el4.ppc.rpm
seamonkey-debuginfo-1.0.9-78.el4.ppc.rpm
seamonkey-devel-1.0.9-78.el4.ppc.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ppc.rpm
seamonkey-js-debugger-1.0.9-78.el4.ppc.rpm
seamonkey-mail-1.0.9-78.el4.ppc.rpm

s390:
seamonkey-1.0.9-78.el4.s390.rpm
seamonkey-chat-1.0.9-78.el4.s390.rpm
seamonkey-debuginfo-1.0.9-78.el4.s390.rpm
seamonkey-devel-1.0.9-78.el4.s390.rpm
seamonkey-dom-inspector-1.0.9-78.el4.s390.rpm
seamonkey-js-debugger-1.0.9-78.el4.s390.rpm
seamonkey-mail-1.0.9-78.el4.s390.rpm

s390x:
seamonkey-1.0.9-78.el4.s390x.rpm
seamonkey-chat-1.0.9-78.el4.s390x.rpm
seamonkey-debuginfo-1.0.9-78.el4.s390x.rpm
seamonkey-devel-1.0.9-78.el4.s390x.rpm
seamonkey-dom-inspector-1.0.9-78.el4.s390x.rpm
seamonkey-js-debugger-1.0.9-78.el4.s390x.rpm
seamonkey-mail-1.0.9-78.el4.s390x.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuDesktoversion 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuES version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuWS version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Thespackages arGPG signed by Red Hat for security Our key and 
details on how tverify thsignaturaravailablfrom
https://access.redhat.com/security/team/key#package

7References:

https://access.redhat.com/security/cve/CVE-2011-3670
https://access.redhat.com/security/cve/CVE-2012-0442
https://access.redhat.com/security/updates/classification#critical

8Contact:

ThRed Hat security contact is  Morcontact
details at https://access.redhat.com/security/team/contact

Copyright 2012 Red Hat, Inc.

Warning: Undefined variable $read_more_added_bug in /var/www/www.linuxsecurity.com-443/html/lsadvisories/lsadvisories.php on line 1148

Red Hat 4: RHSA-2012:0084-01 Critical: Seamonkey Information Exposure

red hat
Calendar Grey February 1, 2012
Dist Redhat Esm H88
Essential seamonkey security patch for Fedora, targeting dual significant vulnerabilities that compromise both operating system stability and user confidentiality.
Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4

Solution

Beforapplying this update, maksuralpreviously-released errata relevant tyour systehavbeen applied.

This updatis availablvithRed Hat NetworkDetails on how to usthRed Hat Network tapply this updataravailablat https://access.redhat.com/kb/docs/DOC-11259

Summary

SeaMonkey is an open sourcweb browser, e-maiand newsgrouclient, IRC chat client, and HTML editor.
A flaw was found in thprocessing of malformed web contentA web page containing malicious content could causSeaMonkey tcrash or, potentially, executarbitrary codwith thprivileges of thuser running SeaMonkey(CVE-2012-0442)
Thsame-origin policy in SeaMonkey treated and as interchangeableA malicious script could possibly usthis flaw tgain access tsensitivinformation (such as client's IP and user e-maiaddress, or httpOnly cookies) that may bincluded in HTTP proxy error replies, generated in responstinvalid URLs using squarbrackets(CVE-2011-3670)
AlSeaMonkey users should upgradtthesupdated packages, which correct thesissuesAfter installing thupdate, SeaMonkey must brestarted for thchanges ttakeffect.

Topics%20covered

Topics Covered

security advisory security update red hat critical cross-site scripting information exposure seamonkey

References

https://access.redhat.com/security/cve/CVE-2011-3670 https://access.redhat.com/security/cve/CVE-2012-0442 https://access.redhat.com/security/updates/classification#critical

Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2012:0084-01
Product: Red Hat EnterprisLinux
Advisory URL: https://access.redhat.com/errata/RHSA-2012:0084.html
Issudate: 2012-02-01

Topic

Updated seamonkey packages that fitwsecurity issues arnow availablefor Red Hat EnterprisLinu4.ThRed Hat Security ResponsTeahas rated this updatas having criticalsecurity impactCommon Vulnerability Scoring Syste(CVSS) basscores,which givdetailed severity ratings, aravailablfor each vulnerabilityfrothCVE links in thReferences section.

Topics%20covered

Topics Covered

security advisory security update red hat critical cross-site scripting information exposure seamonkey

Relevant Releases Architectures

Red Hat EnterprisLinuAS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat EnterprisLinuDesktoversion 4 - i386, x86_64

Red Hat EnterprisLinuES version 4 - i386, ia64, x86_64

Red Hat EnterprisLinuWS version 4 - i386, ia64, x86_64

Bugs Fixed

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)

785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-likhostnamsynta(MFSA 2012-02)

6PackagList:

Red Hat EnterprisLinuAS version 4:

Source:

i386:

seamonkey-1.0.9-78.el4.i386.rpm

seamonkey-chat-1.0.9-78.el4.i386.rpm

seamonkey-debuginfo-1.0.9-78.el4.i386.rpm

seamonkey-devel-1.0.9-78.el4.i386.rpm

seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm

seamonkey-js-debugger-1.0.9-78.el4.i386.rpm

seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:

seamonkey-1.0.9-78.el4.ia64.rpm

seamonkey-chat-1.0.9-78.el4.ia64.rpm

seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm

seamonkey-devel-1.0.9-78.el4.ia64.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm

seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm

seamonkey-mail-1.0.9-78.el4.ia64.rpm

ppc:

seamonkey-1.0.9-78.el4.ppc.rpm

seamonkey-chat-1.0.9-78.el4.ppc.rpm

seamonkey-debuginfo-1.0.9-78.el4.ppc.rpm

seamonkey-devel-1.0.9-78.el4.ppc.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ppc.rpm

seamonkey-js-debugger-1.0.9-78.el4.ppc.rpm

seamonkey-mail-1.0.9-78.el4.ppc.rpm

s390:

seamonkey-1.0.9-78.el4.s390.rpm

seamonkey-chat-1.0.9-78.el4.s390.rpm

seamonkey-debuginfo-1.0.9-78.el4.s390.rpm

seamonkey-devel-1.0.9-78.el4.s390.rpm

seamonkey-dom-inspector-1.0.9-78.el4.s390.rpm

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here