Alerts This Week
Warning Icon 1 700
Alerts This Week
Warning Icon 1 700

Critical Memory Vulnerability in Seamonkey for Red Hat Enterprise Linux 4

Calendar Feb 01, 2012 • User Avatar LinuxSecurity Advisories
4 - 8 min read
Redhat Large Esm H500
Topics%20covered

Topics Covered

security advisory security issue critical software update red hat enterprise seamonkey memory risk
Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

====================================================================                   Red Hat Security Advisory

Synopsis:          Critical: seamonkey security update
Advisory ID:       RHSA-2012:0084-01
Product:           Red Hat EnterprisLinux
Advisory URL:      https://access.redhat.com/errata/RHSA-2012:0084.html
Issudate:        2012-02-01
CVE Names:         CVE-2011-3670 CVE-2012-0442 
====================================================================
1Summary:

Updated seamonkey packages that fitwsecurity issues arnow available
for Red Hat EnterprisLinu4.

ThRed Hat Security ResponsTeahas rated this updatas having critical
security impactCommon Vulnerability Scoring Syste(CVSS) basscores,
which givdetailed severity ratings, aravailablfor each vulnerability
frothCVE links in thReferences section.

2Relevant releases/architectures:

Red Hat EnterprisLinuAS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat EnterprisLinuDesktoversion 4 - i386, x86_64
Red Hat EnterprisLinuES version 4 - i386, ia64, x86_64
Red Hat EnterprisLinuWS version 4 - i386, ia64, x86_64

3Description:

SeaMonkey is an open sourcweb browser, e-maiand newsgrouclient, IRC
chat client, and HTML editor.

A flaw was found in thprocessing of malformed web contentA web page
containing malicious content could causSeaMonkey tcrash or,
potentially, executarbitrary codwith thprivileges of thuser running
SeaMonkey(CVE-2012-0442)

Thsame-origin policy in SeaMonkey treated and
 as interchangeableA malicious script could possibly
usthis flaw tgain access tsensitivinformation (such as client's
IP and user e-maiaddress, or httpOnly cookies) that may bincluded in
HTTP proxy error replies, generated in responstinvalid URLs using
squarbrackets(CVE-2011-3670)

AlSeaMonkey users should upgradtthesupdated packages, which correct
thesissuesAfter installing thupdate, SeaMonkey must brestarted for
thchanges ttakeffect.

4Solution:

Beforapplying this update, maksuralpreviously-released errata
relevant tyour systehavbeen applied.

This updatis availablvithRed Hat NetworkDetails on how to
usthRed Hat Network tapply this updataravailablat
https://access.redhat.com/kb/docs/DOC-11259

5Bugs fixed (http://bugzilla.redhat.com/):

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)
785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-likhostnamsynta(MFSA 2012-02)

6PackagList:

Red Hat EnterprisLinuAS version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

ppc:
seamonkey-1.0.9-78.el4.ppc.rpm
seamonkey-chat-1.0.9-78.el4.ppc.rpm
seamonkey-debuginfo-1.0.9-78.el4.ppc.rpm
seamonkey-devel-1.0.9-78.el4.ppc.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ppc.rpm
seamonkey-js-debugger-1.0.9-78.el4.ppc.rpm
seamonkey-mail-1.0.9-78.el4.ppc.rpm

s390:
seamonkey-1.0.9-78.el4.s390.rpm
seamonkey-chat-1.0.9-78.el4.s390.rpm
seamonkey-debuginfo-1.0.9-78.el4.s390.rpm
seamonkey-devel-1.0.9-78.el4.s390.rpm
seamonkey-dom-inspector-1.0.9-78.el4.s390.rpm
seamonkey-js-debugger-1.0.9-78.el4.s390.rpm
seamonkey-mail-1.0.9-78.el4.s390.rpm

s390x:
seamonkey-1.0.9-78.el4.s390x.rpm
seamonkey-chat-1.0.9-78.el4.s390x.rpm
seamonkey-debuginfo-1.0.9-78.el4.s390x.rpm
seamonkey-devel-1.0.9-78.el4.s390x.rpm
seamonkey-dom-inspector-1.0.9-78.el4.s390x.rpm
seamonkey-js-debugger-1.0.9-78.el4.s390x.rpm
seamonkey-mail-1.0.9-78.el4.s390x.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuDesktoversion 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuES version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Red Hat EnterprisLinuWS version 4:

Source:

i386:
seamonkey-1.0.9-78.el4.i386.rpm
seamonkey-chat-1.0.9-78.el4.i386.rpm
seamonkey-debuginfo-1.0.9-78.el4.i386.rpm
seamonkey-devel-1.0.9-78.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm
seamonkey-js-debugger-1.0.9-78.el4.i386.rpm
seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:
seamonkey-1.0.9-78.el4.ia64.rpm
seamonkey-chat-1.0.9-78.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm
seamonkey-devel-1.0.9-78.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm
seamonkey-mail-1.0.9-78.el4.ia64.rpm

x86_64:
seamonkey-1.0.9-78.el4.x86_64.rpm
seamonkey-chat-1.0.9-78.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-78.el4.x86_64.rpm
seamonkey-devel-1.0.9-78.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-78.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-78.el4.x86_64.rpm
seamonkey-mail-1.0.9-78.el4.x86_64.rpm

Thespackages arGPG signed by Red Hat for security Our key and 
details on how tverify thsignaturaravailablfrom
https://access.redhat.com/security/team/key#package

7References:

https://access.redhat.com/security/cve/CVE-2011-3670
https://access.redhat.com/security/cve/CVE-2012-0442
https://access.redhat.com/security/updates/classification#critical

8Contact:

ThRed Hat security contact is  Morcontact
details at https://access.redhat.com/security/team/contact

Copyright 2012 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFPKPcoXlSAg2UNWIIRAtqTAKC3n9KoTOm2t/qukrnH+cd04iswBgCeIu8r
IceFLSepAEZDsTcaPufEfgc=QPg3
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
This email address is being protected from spambots. You need JavaScript enabled to view it.

Warning: Undefined variable $read_more_added_bug in /var/www/www.linuxsecurity.com-443/html/lsadvisories/lsadvisories.php on line 1148

Critical Memory Vulnerability in Seamonkey for Red Hat Enterprise Linux 4

red hat
Calendar Grey February 1, 2012
Dist Redhat Esm H88
Crucial SeaMonkey upgrade released for Red Hat addresses significant security flaws. It is vital to update for safeguarding against potential exploits.
Updated seamonkey packages that fix two security issues are now available for Red Hat Enterprise Linux 4

Solution

Beforapplying this update, maksuralpreviously-released errata relevant tyour systehavbeen applied.

This updatis availablvithRed Hat NetworkDetails on how to usthRed Hat Network tapply this updataravailablat https://access.redhat.com/kb/docs/DOC-11259

Summary

SeaMonkey is an open sourcweb browser, e-maiand newsgrouclient, IRC chat client, and HTML editor.
A flaw was found in thprocessing of malformed web contentA web page containing malicious content could causSeaMonkey tcrash or, potentially, executarbitrary codwith thprivileges of thuser running SeaMonkey(CVE-2012-0442)
Thsame-origin policy in SeaMonkey treated and as interchangeableA malicious script could possibly usthis flaw tgain access tsensitivinformation (such as client's IP and user e-maiaddress, or httpOnly cookies) that may bincluded in HTTP proxy error replies, generated in responstinvalid URLs using squarbrackets(CVE-2011-3670)
AlSeaMonkey users should upgradtthesupdated packages, which correct thesissuesAfter installing thupdate, SeaMonkey must brestarted for thchanges ttakeffect.

Topics%20covered

Topics Covered

security advisory security issue critical software update red hat enterprise seamonkey memory risk

References

https://access.redhat.com/security/cve/CVE-2011-3670 https://access.redhat.com/security/cve/CVE-2012-0442 https://access.redhat.com/security/updates/classification#critical

Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2012:0084-01
Product: Red Hat EnterprisLinux
Advisory URL: https://access.redhat.com/errata/RHSA-2012:0084.html
Issudate: 2012-02-01

Topic

Updated seamonkey packages that fitwsecurity issues arnow availablefor Red Hat EnterprisLinu4.ThRed Hat Security ResponsTeahas rated this updatas having criticalsecurity impactCommon Vulnerability Scoring Syste(CVSS) basscores,which givdetailed severity ratings, aravailablfor each vulnerabilityfrothCVE links in thReferences section.

Topics%20covered

Topics Covered

security advisory security issue critical software update red hat enterprise seamonkey memory risk

Relevant Releases Architectures

Red Hat EnterprisLinuAS version 4 - i386, ia64, ppc, s390, s390x, x86_64

Red Hat EnterprisLinuDesktoversion 4 - i386, x86_64

Red Hat EnterprisLinuES version 4 - i386, ia64, x86_64

Red Hat EnterprisLinuWS version 4 - i386, ia64, x86_64

Bugs Fixed

785085 - CVE-2012-0442 Mozilla: memory safety hazards in 10.0/1.9.2.26 (MFSA 2012-01)

785464 - CVE-2011-3670 Mozilla: Same-origin bypass using IPv6-likhostnamsynta(MFSA 2012-02)

6PackagList:

Red Hat EnterprisLinuAS version 4:

Source:

i386:

seamonkey-1.0.9-78.el4.i386.rpm

seamonkey-chat-1.0.9-78.el4.i386.rpm

seamonkey-debuginfo-1.0.9-78.el4.i386.rpm

seamonkey-devel-1.0.9-78.el4.i386.rpm

seamonkey-dom-inspector-1.0.9-78.el4.i386.rpm

seamonkey-js-debugger-1.0.9-78.el4.i386.rpm

seamonkey-mail-1.0.9-78.el4.i386.rpm

ia64:

seamonkey-1.0.9-78.el4.ia64.rpm

seamonkey-chat-1.0.9-78.el4.ia64.rpm

seamonkey-debuginfo-1.0.9-78.el4.ia64.rpm

seamonkey-devel-1.0.9-78.el4.ia64.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ia64.rpm

seamonkey-js-debugger-1.0.9-78.el4.ia64.rpm

seamonkey-mail-1.0.9-78.el4.ia64.rpm

ppc:

seamonkey-1.0.9-78.el4.ppc.rpm

seamonkey-chat-1.0.9-78.el4.ppc.rpm

seamonkey-debuginfo-1.0.9-78.el4.ppc.rpm

seamonkey-devel-1.0.9-78.el4.ppc.rpm

seamonkey-dom-inspector-1.0.9-78.el4.ppc.rpm

seamonkey-js-debugger-1.0.9-78.el4.ppc.rpm

seamonkey-mail-1.0.9-78.el4.ppc.rpm

s390:

seamonkey-1.0.9-78.el4.s390.rpm

seamonkey-chat-1.0.9-78.el4.s390.rpm

seamonkey-debuginfo-1.0.9-78.el4.s390.rpm

seamonkey-devel-1.0.9-78.el4.s390.rpm

seamonkey-dom-inspector-1.0.9-78.el4.s390.rpm

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here