Scientific Linux: CVE-2012-0442 Critical: Thunderbird SL4/SL5 i386/x86_64

Date: Wed, 1 Feb 2012 14:00:05 -0600
Reply-To: This email address is being protected from spambots. You need JavaScript enabled to view it.
Sender: Security Erratfor ScientifiLinux
 
From: This email address is being protected from spambots. You need JavaScript enabled to view it.
Subject: Security ERRATA Critical: thunderbird on SL4.x, SL5.i386/x86_64
Comments: To: This email address is being protected from spambots. You need JavaScript enabled to view it.

Synopsis: Critical: thunderbird security update
IssuDate: 2012-02-01
CVE Numbers: CVE-2012-0442
 CVE-2011-3670

MozillThunderbird is standalonmaiand newsgrouclient.

A flaw was found in thprocessing of malformed contentAn HTML mail
messagcontaining malicious content could causThunderbird tcrash or,
potentially, executarbitrary codwith thprivileges of thuser running
Thunderbird(CVE-2012-0442)

Thsame-origin policy in Thunderbird treated and
 as interchangeableA malicious script could possibly
usthis flaw tgain access tsensitivinformation (such as client's
IP and user e-maiaddress, or httpOnly cookies) that may bincluded in
HTTP proxy error replies, generated in responstinvalid URLs using
squarbrackets(CVE-2011-3670)

Note: ThCVE-2011-3670 issucannot bexploited by specially-crafted
HTML maimessagas JavaScript is disabled by default for maimessages.
It could bexploited another way in Thunderbird, for example, when viewing
thfulremotcontent of an RSS feed.

AlThunderbird users should upgradtthis updated package, which
resolves thesissuesAlrunning instances of Thunderbird must be
restarted for thupdatttakeffect.

SL4:
 i386
 thunderbird-1.5.0.12-46.el4.i386.rpm
 thunderbird-debuginfo-1.5.0.12-46.el4.i386.rpm
 x86_64
 thunderbird-1.5.0.12-46.el4.x86_64.rpm
 thunderbird-debuginfo-1.5.0.12-46.el4.x86_64.rpm
SL5:
 i386
 thunderbird-2.0.0.24-28.el5_7.i386.rpm
 thunderbird-debuginfo-2.0.0.24-28.el5_7.i386.rpm
 x86_64
 thunderbird-2.0.0.24-28.el5_7.x86_64.rpm
 thunderbird-debuginfo-2.0.0.24-28.el5_7.x86_64.rpm

- ScientifiLinuDevelopment Team