Scientific Linux SL6: 2012-02-16 Critical: Thunderbird Buffer Overflow

Date: Thu, 16 Feb 2012 16:41:44 -0600
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: Security Errata for Scientific Linux
 
From: This email address is being protected from spambots. You need JavaScript enabled to view it.
Subject: Security ERRATA Critical: thunderbird on SL6.x i386/x86_64
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.

Synopsis: Critical: thunderbird security update
Issue Date: 2012-02-16
CVE Numbers: CVE-2011-3026

Mozilla Thunderbird is a standalone mail and newsgroup client.

A heap-based buffer overflow flaw was found in the way Thunderbird handled
PNG (Portable Network Graphics) images. An HTML mail message or remote
content containing a specially-crafted PNG image could cause Thunderbird to
crash or, possibly, execute arbitrary code with the privileges of the user
running Thunderbird. (CVE-2011-3026)

All Thunderbird users should upgrade to this updated package, which
corrects this issue. After installing the update, Thunderbird must be
restarted for the changes to take effect.

SL6:
 i386
 thunderbird-3.1.18-2.el6_2.i686.rpm
 thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm
 x86_64
 thunderbird-3.1.18-2.el6_2.x86_64.rpm
 thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm

- Scientific Linux Development Team