Date:         Wed, 21 Jul 2010 13:34:16 -0500
Reply-To:     Troy Dawson 
Sender:       Security Errata for Scientific Linux
              
From:         Troy Dawson 
Subject:      Security ERRATA Critical: seamonkey on SL3.x, SL4.x i386/x86_64
Comments: To: "scientific-linux-errata@fnal.gov"
          

Synopsis:	Critical: seamonkey security update
Issue date:	2010-07-20
CVE Names:	CVE-2010-1205 CVE-2010-1211 CVE-2010-1214
                   CVE-2010-2751 CVE-2010-2753 CVE-2010-2754

Several flaws were found in the processing of malformed web content. A 
web page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code with the privileges of the user 
running SeaMonkey. (CVE-2010-1211, CVE-2010-2753, CVE-2010-1214)

A memory corruption flaw was found in the way SeaMonkey decoded certain 
PNG images. An attacker could create a specially-crafted PNG image that, 
when opened, could cause SeaMonkey to crash or, potentially, execute 
arbitrary code with the privileges of the user running SeaMonkey. 
(CVE-2010-1205)

A same-origin policy bypass flaw was found in SeaMonkey. An attacker 
could create a malicious web page that, when viewed by a victim, could 
steal private data from a different website the victim has loaded with 
SeaMonkey. (CVE-2010-2754)

A flaw was found in the way SeaMonkey displayed the location bar when
visiting a secure web page. A malicious server could use this flaw to
present data that appears to originate from a secure server, even though 
it does not. (CVE-2010-2751)

SeaMonkey must be restarted for the changes to take effect.

SL 3.0.x

      SRPMS:
seamonkey-1.0.9-0.57.el3.src.rpm
      i386:
seamonkey-1.0.9-0.57.el3.i386.rpm
seamonkey-chat-1.0.9-0.57.el3.i386.rpm
seamonkey-devel-1.0.9-0.57.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.57.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.57.el3.i386.rpm
seamonkey-mail-1.0.9-0.57.el3.i386.rpm
seamonkey-nspr-1.0.9-0.57.el3.i386.rpm
seamonkey-nspr-devel-1.0.9-0.57.el3.i386.rpm
seamonkey-nss-1.0.9-0.57.el3.i386.rpm
seamonkey-nss-devel-1.0.9-0.57.el3.i386.rpm
      x86_64:
seamonkey-1.0.9-0.57.el3.i386.rpm
seamonkey-1.0.9-0.57.el3.x86_64.rpm
seamonkey-chat-1.0.9-0.57.el3.i386.rpm
seamonkey-chat-1.0.9-0.57.el3.x86_64.rpm
seamonkey-devel-1.0.9-0.57.el3.x86_64.rpm
seamonkey-dom-inspector-1.0.9-0.57.el3.i386.rpm
seamonkey-dom-inspector-1.0.9-0.57.el3.x86_64.rpm
seamonkey-js-debugger-1.0.9-0.57.el3.i386.rpm
seamonkey-js-debugger-1.0.9-0.57.el3.x86_64.rpm
seamonkey-mail-1.0.9-0.57.el3.i386.rpm
seamonkey-mail-1.0.9-0.57.el3.x86_64.rpm
seamonkey-nspr-1.0.9-0.57.el3.i386.rpm
seamonkey-nspr-1.0.9-0.57.el3.x86_64.rpm
seamonkey-nspr-devel-1.0.9-0.57.el3.x86_64.rpm
seamonkey-nss-1.0.9-0.57.el3.i386.rpm
seamonkey-nss-1.0.9-0.57.el3.x86_64.rpm
seamonkey-nss-devel-1.0.9-0.57.el3.x86_64.rpm

SL 4.x

      SRPMS:
seamonkey-1.0.9-60.el4.src.rpm
      i386:
seamonkey-1.0.9-60.el4.i386.rpm
seamonkey-chat-1.0.9-60.el4.i386.rpm
seamonkey-devel-1.0.9-60.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-60.el4.i386.rpm
seamonkey-js-debugger-1.0.9-60.el4.i386.rpm
seamonkey-mail-1.0.9-60.el4.i386.rpm
      x86_64:
seamonkey-1.0.9-60.el4.i386.rpm
seamonkey-1.0.9-60.el4.x86_64.rpm
seamonkey-chat-1.0.9-60.el4.i386.rpm
seamonkey-chat-1.0.9-60.el4.x86_64.rpm
seamonkey-devel-1.0.9-60.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-60.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-60.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-60.el4.i386.rpm
seamonkey-js-debugger-1.0.9-60.el4.x86_64.rpm
seamonkey-mail-1.0.9-60.el4.i386.rpm
seamonkey-mail-1.0.9-60.el4.x86_64.rpm


-Connie Sieh
-Troy Dawson

SciLinux: CVE-2010-1205 Critical: seamonkey SL3.x, SL4.x i386/x86_64

Critical: seamonkey security update

Summary

web page containing malicious content could cause SeaMonkey to crash or,potentially, execute arbitrary code with the privileges of the userrunning SeaMonkey. (CVE-2010-1211, CVE-2010-2753, CVE-2010-1214)A memory corruption flaw was found in the way SeaMonkey decoded certainPNG images. An attacker could create a specially-crafted PNG image that,when opened, could cause SeaMonkey to crash or, potentially, executearbitrary code with the privileges of the user running SeaMonkey.(CVE-2010-1205)A same-origin policy bypass flaw was found in SeaMonkey. An attackercould create a malicious web page that, when viewed by a victim, couldsteal private data from a different website the victim has loaded withSeaMonkey. (CVE-2010-2754)A flaw was found in the way SeaMonkey displayed the location bar whenvisiting a secure web page. A malicious server could use this flaw topresent data that appears to originate from a secure server, even thoughit does not. (CVE-2010-2751)SeaMonkey must be restarted for the changes to take effect.SL 3.0.xSRPMS:seamonkey-1.0.9-0.57.el3.src.rpmi386:seamonkey-1.0.9-0.57.el3.i386.rpmseamonkey-chat-1.0.9-0.57.el3.i386.rpmseamonkey-devel-1.0.9-0.57.el3.i386.rpmseamonkey-dom-inspector-1.0.9-0.57.el3.i386.rpmseamonkey-js-debugger-1.0.9-0.57.el3.i386.rpmseamonkey-mail-1.0.9-0.57.el3.i386.rpmseamonkey-nspr-1.0.9-0.57.el3.i386.rpmseamonkey-nspr-devel-1.0.9-0.57.el3.i386.rpmseamonkey-nss-1.0.9-0.57.el3.i386.rpmseamonkey-nss-devel-1.0.9-0.57.el3.i386.rpmx86_64:seamonkey-1.0.9-0.57.el3.i386.rpmseamonkey-1.0.9-0.57.el3.x86_64.rpmseamonkey-chat-1.0.9-0.57.el3.i386.rpmseamonkey-chat-1.0.9-0.57.el3.x86_64.rpmseamonkey-devel-1.0.9-0.57.el3.x86_64.rpmseamonkey-dom-inspector-1.0.9-0.57.el3.i386.rpmseamonkey-dom-inspector-1.0.9-0.57.el3.x86_64.rpmseamonkey-js-debugger-1.0.9-0.57.el3.i386.rpmseamonkey-js-debugger-1.0.9-0.57.el3.x86_64.rpmseamonkey-mail-1.0.9-0.57.el3.i386.rpmseamonkey-mail-1.0.9-0.57.el3.x86_64.rpmseamonkey-nspr-1.0.9-0.57.el3.i386.rpmseamonkey-nspr-1.0.9-0.57.el3.x86_64.rpmseamonkey-nspr-devel-1.0.9-0.57.el3.x86_64.rpmseamonkey-nss-1.0.9-0.57.el3.i386.rpmseamonkey-nss-1.0.9-0.57.el3.x86_64.rpmseamonkey-nss-devel-1.0.9-0.57.el3.x86_64.rpm



Security Fixes

Severity
Issued Date: : 2010-07-20
CVE Names: CVE-2010-1205 CVE-2010-1211 CVE-2010-1214
CVE-2010-2751 CVE-2010-2753 CVE-2010-2754
Several flaws were found in the processing of malformed web content. A

Related News

22.Lock ScreenEffect Esm H320
1 - 2 min read
EndeavorOS Gemini is a captivating and charming desktop operating system based on Arch Linux. The new release includes a kernel upgrade, 3D graphics
25.@Sign Hook Keyboard Esm H320
1 min read
Cyber risk is increasing for individuals and organizations, making flexible and robust solutions for identifying spam and malware increasingly
19.Laptop Bed Esm H320
2 - 3 min read
The recently released Linux Kernel 6.9 brings forth a blend of crucial upgrades and enhancements, catering to the ever-evolving needs of the Linux
4.Lock AbstractDigital Esm H320
1 - 2 min read
Nmap 7.95 introduces myriad enhancements, primarily focusing on OS and service detection signatures. This reflects the dedication of the Nmap
5.ShakingHands Esm H320
3 - 5 min read
There has been a promising shift in the tech industry, with major companies pledging to release products with built-in security features. This
18.WifiCutout Landscape Esm H320
2 - 3 min read
A novel attack called TunnelVision has been discovered. It compromises the security of virtually all VPN apps, rendering their purpose useless. The
21.Globe RadiatingCode Esm H320
2 - 3 min read
The recent discovery of a backdoor in XZ Utils , a widely used Linux tool, raises concerns about the security of the open-source ecosystem. While
13.Lock StylizedMotherboard Esm H320
1 - 2 min read
Spiral Linux is a Debian-based distribution that offers a range of desktop environments, making it stand out from other Linux distributions. In

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved