--------------------------------------------------------------------- Fedora Update Notification FEDORA-2006-489 2006-05-03 ---------------------------------------------------------------------
Product : Fedora Core 4 Name : thunderbird Version : 1.0.8 Release : 1.1.fc4 Summary : Mozilla Thunderbird mail/newsgroup client Description : Mozilla Thunderbird is a standalone mail and newsgroup client.
--------------------------------------------------------------------- Update Information:
Updated thunderbird packages that fix various bugs are now available for Fedora Core 4.
This update has been rated as having critical security impact by the Fedora Security Response Team.
Mozilla Thunderbird is a standalone mail and newsgroup client.
Several bugs were found in the way Thunderbird processes malformed javascript. A malicious HTML mail message could modify the content of a different open HTML mail message, possibly stealing sensitive information or conducting a cross-site scripting attack. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-1731, CVE-2006-1732, CVE-2006-1741)
Several bugs were found in the way Thunderbird processes certain javascript actions. A malicious HTML mail message could execute arbitrary javascript instructions with the permissions of 'chrome', allowing the page to steal sensitive information or install browser malware. Please note that JavaScript support is disabled by default in Thunderbird. (CVE-2006-0292, CVE-2006-0296, CVE-2006-1727, CVE-2006-1728, CVE-2006-1733, CVE-2006-1734, CVE-2006-1735, CVE-2006-1742)
Several bugs were found in the way Thunderbird processes malformed HTML mail messages. A carefully crafted malicious HTML mail message could cause the execution of arbitrary code as the user running Thunderbird. (CVE-2006-0748, CVE-2006-0749, CVE-2006-1724, CVE-2006-1730, CVE-2006-1737, CVE-2006-1738, CVE-2006-1739, CVE-2006-1790)
A bug was found in the way Thunderbird processes certain inline content in HTML mail messages. It may be possible for a remote attacker to send a carefully crafted mail message to the victim, which will fetch remote content, even if Thunderbird is configured not to fetch remote content. (CVE-2006-1045)
A bug was found in the way Thunderbird executes in-line mail forwarding. If a user can be tricked into forwarding a maliciously crafted mail message as in-line content, it is possible for the message to execute javascript with the permissions of "chrome". (CVE-2006-0884)
Users of Thunderbird are advised to upgrade to these updated packages containing Thunderbird version 1.0.8, which is not vulnerable to these issues.
--------------------------------------------------------------------- * Wed Apr 19 2006 Christopher Aillon caillon@redhat.com 1.0.8-1.1.fc4 - Update to 1.0.8
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
7d0be6f68920d11fea4104a06cd03d5849c95005 SRPMS/thunderbird-1.0.8-1.1.fc4.src.rpm ecac8c7c6f8097f1a1ed1e5e5a4aa38bdcbf8294 ppc/thunderbird-1.0.8-1.1.fc4.ppc.rpm 8cf3a7c1999cc1c97cfbc861455bf181ffc23e42 ppc/debug/thunderbird-debuginfo-1.0.8-1.1.fc4.ppc.rpm 81e6434b2c0949fd37c0c86d1ad1b492eedc8760 x86_64/thunderbird-1.0.8-1.1.fc4.x86_64.rpm a9d48d6afda88e8ce5ba514112765d945ba38bd3 x86_64/debug/thunderbird-debuginfo-1.0.8-1.1.fc4.x86_64.rpm 739ff0c09be68c513d577c1f7a0b7abcb7ccdf33 i386/thunderbird-1.0.8-1.1.fc4.i386.rpm 66a5f5e4463926d52f97011295b70046435d2678 i386/debug/thunderbird-debuginfo-1.0.8-1.1.fc4.i386.rpm
This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at http://fedora.redhat.com/docs/yum/. ---------------------------------------------------------------------