sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

[SM-Security] Security vulnerabilities reported in thunderbird < 2.0.0.16

From: George Sherwood <pilot AT beernabeer.com>
To: sm-security AT lists.ibiblio.org
Subject: [SM-Security] Security vulnerabilities reported in thunderbird < 2.0.0.16
Date: Fri, 26 Sep 2008 14:27:07 -0500

Synopsis
========
Critical security vulnerabilities have been found in thunderbird 2.0.0.17
and below.

Background
==========
Thunderbird is email client of the Mozilla project.

Description
===========
Fixed in Thunderbird 2.0.0.17
MFSA 2008-46 Heap overflow when canceling newsgroup message
MFSA 2008-44 resource: traversal vulnerabilities
MFSA 2008-43 BOM characters stripped from JavaScript before execution
MFSA 2008-42 Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17)
MFSA 2008-41 Privilege escalation via XPCnativeWrapper pollution
MFSA 2008-38 nsXMLDocument::OnChannelRedirect() same-origin violation
MFSA 2008-37 UTF-8 URL stack buffer overflow [0]

Affected packages
=================
These vulnerabilities were reported for thunderbird 2.0.0.16. Thunderbird in
all grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All thunderbird users should upgrade to the latest available version:
# scribe update
# cast -c thunderbird

If you maintain your own installation of thunderbird ouside of sorcery, there
are patches available from upstream.

References
==========
[0]http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.html#thunderbird2.0.0.17

Attachment: signature.asc
Description: PGP signature

[SM-Security] Security vulnerabilities reported in thunderbird < 2.0.0.16, George Sherwood, 09/26/2008