Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2008.0133 -- [RedHat] firefox seamonkey and thunderbird security updates 29 February 2008 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Firefox 2.0.0.11 and prior Thunderbird 2.0.0.11 and prior SeaMonkey 1.1.7 and prior Publisher: Red Hat Operating System: Red Hat Linux 5 Red Hat Linux 4 Impact: Execute Arbitrary Code/Commands Access Confidential Data Read-only Data Access Cross-site Scripting Denial of Service Inappropriate Access Provide Misleading Information Access: Remote/Unauthenticated CVE Names: CVE-2008-0593 CVE-2008-0592 CVE-2008-0591 CVE-2008-0419 CVE-2008-0418 CVE-2008-0417 CVE-2008-0415 CVE-2008-0413 CVE-2008-0412 Ref: AL-2008.0014 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2008-0103.html https://rhn.redhat.com/errata/RHSA-2008-0104.html https://rhn.redhat.com/errata/RHSA-2008-0105.html Comment: This ESB contains three (3) seperate RedHat advisories. Revision History: February 29 2008: 0105 updated to include the details of additional issues that were fixed by these erratum packages, but which were not publc at the time of release. No changes have been made to the packages. February 8 2008: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: firefox security update Advisory ID: RHSA-2008:0103-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0103.html Issue date: 2008-02-07 CVE Names: CVE-2008-0412 CVE-2008-0413 CVE-2008-0415 CVE-2008-0417 CVE-2008-0418 CVE-2008-0419 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 ===================================================================== 1. Summary: Updated firefox packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 3. Description: Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way Firefox displayed malformed web content. A webpage containing specially-crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593) A flaw was found in the way Firefox stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417) A flaw was found in the way Firefox handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of Firefox. (CVE-2008-0418) A flaw was found in the way Firefox saves certain text files. If a website offers a file of type "plain/text", rather than "text/plain", Firefox will not show future "text/plain" content to the user in the browser, forcing them to save those files locally to view the content. (CVE-2008-0592) Users of firefox are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 431732 - CVE-2008-0412 Mozilla layout engine crashes 431733 - CVE-2008-0413 Mozilla javascript engine crashes 431739 - CVE-2008-0415 Mozilla arbitrary code execution 431742 - CVE-2008-0417 Mozilla arbitrary code execution 431748 - CVE-2008-0418 Mozilla chrome: directory traversal 431749 - CVE-2008-0419 Mozilla arbitrary code execution 431751 - CVE-2008-0591 Mozilla information disclosure flaw 431752 - CVE-2008-0592 Mozilla text file mishandling 431756 - CVE-2008-0593 Mozilla URL token stealing flaw 6. Package List: Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-1.5.0.12-0.10.el4.src.rpm i386: firefox-1.5.0.12-0.10.el4.i386.rpm firefox-debuginfo-1.5.0.12-0.10.el4.i386.rpm ia64: firefox-1.5.0.12-0.10.el4.ia64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.ia64.rpm ppc: firefox-1.5.0.12-0.10.el4.ppc.rpm firefox-debuginfo-1.5.0.12-0.10.el4.ppc.rpm s390: firefox-1.5.0.12-0.10.el4.s390.rpm firefox-debuginfo-1.5.0.12-0.10.el4.s390.rpm s390x: firefox-1.5.0.12-0.10.el4.s390x.rpm firefox-debuginfo-1.5.0.12-0.10.el4.s390x.rpm x86_64: firefox-1.5.0.12-0.10.el4.x86_64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-1.5.0.12-0.10.el4.src.rpm i386: firefox-1.5.0.12-0.10.el4.i386.rpm firefox-debuginfo-1.5.0.12-0.10.el4.i386.rpm x86_64: firefox-1.5.0.12-0.10.el4.x86_64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-1.5.0.12-0.10.el4.src.rpm i386: firefox-1.5.0.12-0.10.el4.i386.rpm firefox-debuginfo-1.5.0.12-0.10.el4.i386.rpm ia64: firefox-1.5.0.12-0.10.el4.ia64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.ia64.rpm x86_64: firefox-1.5.0.12-0.10.el4.x86_64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-1.5.0.12-0.10.el4.src.rpm i386: firefox-1.5.0.12-0.10.el4.i386.rpm firefox-debuginfo-1.5.0.12-0.10.el4.i386.rpm ia64: firefox-1.5.0.12-0.10.el4.ia64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.ia64.rpm x86_64: firefox-1.5.0.12-0.10.el4.x86_64.rpm firefox-debuginfo-1.5.0.12-0.10.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-1.5.0.12-9.el5.src.rpm i386: firefox-1.5.0.12-9.el5.i386.rpm firefox-debuginfo-1.5.0.12-9.el5.i386.rpm x86_64: firefox-1.5.0.12-9.el5.i386.rpm firefox-1.5.0.12-9.el5.x86_64.rpm firefox-debuginfo-1.5.0.12-9.el5.i386.rpm firefox-debuginfo-1.5.0.12-9.el5.x86_64.rpm RHEL Desktop Workstation (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-1.5.0.12-9.el5.src.rpm i386: firefox-debuginfo-1.5.0.12-9.el5.i386.rpm firefox-devel-1.5.0.12-9.el5.i386.rpm x86_64: firefox-debuginfo-1.5.0.12-9.el5.i386.rpm firefox-debuginfo-1.5.0.12-9.el5.x86_64.rpm firefox-devel-1.5.0.12-9.el5.i386.rpm firefox-devel-1.5.0.12-9.el5.x86_64.rpm Red Hat Enterprise Linux (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-1.5.0.12-9.el5.src.rpm i386: firefox-1.5.0.12-9.el5.i386.rpm firefox-debuginfo-1.5.0.12-9.el5.i386.rpm firefox-devel-1.5.0.12-9.el5.i386.rpm ia64: firefox-1.5.0.12-9.el5.ia64.rpm firefox-debuginfo-1.5.0.12-9.el5.ia64.rpm firefox-devel-1.5.0.12-9.el5.ia64.rpm ppc: firefox-1.5.0.12-9.el5.ppc.rpm firefox-debuginfo-1.5.0.12-9.el5.ppc.rpm firefox-devel-1.5.0.12-9.el5.ppc.rpm s390x: firefox-1.5.0.12-9.el5.s390.rpm firefox-1.5.0.12-9.el5.s390x.rpm firefox-debuginfo-1.5.0.12-9.el5.s390.rpm firefox-debuginfo-1.5.0.12-9.el5.s390x.rpm firefox-devel-1.5.0.12-9.el5.s390.rpm firefox-devel-1.5.0.12-9.el5.s390x.rpm x86_64: firefox-1.5.0.12-9.el5.i386.rpm firefox-1.5.0.12-9.el5.x86_64.rpm firefox-debuginfo-1.5.0.12-9.el5.i386.rpm firefox-debuginfo-1.5.0.12-9.el5.x86_64.rpm firefox-devel-1.5.0.12-9.el5.i386.rpm firefox-devel-1.5.0.12-9.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0413 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0415 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0417 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0418 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0419 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0591 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0592 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0593 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHq8P3XlSAg2UNWIIRAiwUAKDEhVOF1MaHoBHoxZJfkm1to0LjHQCfe3tz YXAwimdo3jkWcuehgg5OTRc= =DP8X - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: seamonkey security update Advisory ID: RHSA-2008:0104-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0104.html Issue date: 2008-02-07 CVE Names: CVE-2008-0412 CVE-2008-0413 CVE-2008-0415 CVE-2008-0417 CVE-2008-0418 CVE-2008-0419 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 ===================================================================== 1. Summary: Updated seamonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1, 3, and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processed certain malformed web content. A webpage containing malicious content could cause SeaMonkey to crash, or potentially execute arbitrary code as the user running SeaMonkey. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way SeaMonkey displayed malformed web content. A webpage containing specially-crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593) A flaw was found in the way SeaMonkey stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417) A flaw was found in the way SeaMonkey handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of SeaMonkey. (CVE-2008-0418) A flaw was found in the way SeaMonkey saves certain text files. If a website offers a file of type "plain/text", rather than "text/plain", SeaMonkey will not show future "text/plain" content to the user in the browser, forcing them to save those files locally to view the content. (CVE-2008-0592) Users of SeaMonkey are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 431732 - CVE-2008-0412 Mozilla layout engine crashes 431733 - CVE-2008-0413 Mozilla javascript engine crashes 431739 - CVE-2008-0415 Mozilla arbitrary code execution 431742 - CVE-2008-0417 Mozilla arbitrary code execution 431748 - CVE-2008-0418 Mozilla chrome: directory traversal 431749 - CVE-2008-0419 Mozilla arbitrary code execution 431751 - CVE-2008-0591 Mozilla information disclosure flaw 431752 - CVE-2008-0592 Mozilla text file mishandling 431756 - CVE-2008-0593 Mozilla URL token stealing flaw 6. Package List: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 : Source: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/seamonkey-1.0.9-0.9.el2.src.rpm i386: seamonkey-1.0.9-0.9.el2.i386.rpm seamonkey-chat-1.0.9-0.9.el2.i386.rpm seamonkey-devel-1.0.9-0.9.el2.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el2.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el2.i386.rpm seamonkey-mail-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el2.i386.rpm seamonkey-nss-1.0.9-0.9.el2.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el2.i386.rpm ia64: seamonkey-1.0.9-0.9.el2.ia64.rpm seamonkey-chat-1.0.9-0.9.el2.ia64.rpm seamonkey-devel-1.0.9-0.9.el2.ia64.rpm seamonkey-dom-inspector-1.0.9-0.9.el2.ia64.rpm seamonkey-js-debugger-1.0.9-0.9.el2.ia64.rpm seamonkey-mail-1.0.9-0.9.el2.ia64.rpm seamonkey-nspr-1.0.9-0.9.el2.ia64.rpm seamonkey-nspr-devel-1.0.9-0.9.el2.ia64.rpm seamonkey-nss-1.0.9-0.9.el2.ia64.rpm seamonkey-nss-devel-1.0.9-0.9.el2.ia64.rpm Red Hat Linux Advanced Workstation 2.1: Source: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/seamonkey-1.0.9-0.9.el2.src.rpm ia64: seamonkey-1.0.9-0.9.el2.ia64.rpm seamonkey-chat-1.0.9-0.9.el2.ia64.rpm seamonkey-devel-1.0.9-0.9.el2.ia64.rpm seamonkey-dom-inspector-1.0.9-0.9.el2.ia64.rpm seamonkey-js-debugger-1.0.9-0.9.el2.ia64.rpm seamonkey-mail-1.0.9-0.9.el2.ia64.rpm seamonkey-nspr-1.0.9-0.9.el2.ia64.rpm seamonkey-nspr-devel-1.0.9-0.9.el2.ia64.rpm seamonkey-nss-1.0.9-0.9.el2.ia64.rpm seamonkey-nss-devel-1.0.9-0.9.el2.ia64.rpm Red Hat Enterprise Linux ES version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/seamonkey-1.0.9-0.9.el2.src.rpm i386: seamonkey-1.0.9-0.9.el2.i386.rpm seamonkey-chat-1.0.9-0.9.el2.i386.rpm seamonkey-devel-1.0.9-0.9.el2.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el2.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el2.i386.rpm seamonkey-mail-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el2.i386.rpm seamonkey-nss-1.0.9-0.9.el2.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el2.i386.rpm Red Hat Enterprise Linux WS version 2.1: Source: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/seamonkey-1.0.9-0.9.el2.src.rpm i386: seamonkey-1.0.9-0.9.el2.i386.rpm seamonkey-chat-1.0.9-0.9.el2.i386.rpm seamonkey-devel-1.0.9-0.9.el2.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el2.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el2.i386.rpm seamonkey-mail-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-1.0.9-0.9.el2.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el2.i386.rpm seamonkey-nss-1.0.9-0.9.el2.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el2.i386.rpm Red Hat Enterprise Linux AS version 3: Source: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/seamonkey-1.0.9-0.9.el3.src.rpm i386: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-chat-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-devel-1.0.9-0.9.el3.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el3.i386.rpm seamonkey-mail-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el3.i386.rpm ia64: seamonkey-1.0.9-0.9.el3.ia64.rpm seamonkey-chat-1.0.9-0.9.el3.ia64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.ia64.rpm seamonkey-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.ia64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.ia64.rpm seamonkey-mail-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.ia64.rpm ppc: seamonkey-1.0.9-0.9.el3.ppc.rpm seamonkey-chat-1.0.9-0.9.el3.ppc.rpm seamonkey-debuginfo-1.0.9-0.9.el3.ppc.rpm seamonkey-devel-1.0.9-0.9.el3.ppc.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.ppc.rpm seamonkey-js-debugger-1.0.9-0.9.el3.ppc.rpm seamonkey-mail-1.0.9-0.9.el3.ppc.rpm seamonkey-nspr-1.0.9-0.9.el3.ppc.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.ppc.rpm seamonkey-nss-1.0.9-0.9.el3.ppc.rpm seamonkey-nss-devel-1.0.9-0.9.el3.ppc.rpm s390: seamonkey-1.0.9-0.9.el3.s390.rpm seamonkey-chat-1.0.9-0.9.el3.s390.rpm seamonkey-debuginfo-1.0.9-0.9.el3.s390.rpm seamonkey-devel-1.0.9-0.9.el3.s390.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.s390.rpm seamonkey-js-debugger-1.0.9-0.9.el3.s390.rpm seamonkey-mail-1.0.9-0.9.el3.s390.rpm seamonkey-nspr-1.0.9-0.9.el3.s390.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.s390.rpm seamonkey-nss-1.0.9-0.9.el3.s390.rpm seamonkey-nss-devel-1.0.9-0.9.el3.s390.rpm s390x: seamonkey-1.0.9-0.9.el3.s390x.rpm seamonkey-chat-1.0.9-0.9.el3.s390x.rpm seamonkey-debuginfo-1.0.9-0.9.el3.s390.rpm seamonkey-debuginfo-1.0.9-0.9.el3.s390x.rpm seamonkey-devel-1.0.9-0.9.el3.s390x.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.s390x.rpm seamonkey-js-debugger-1.0.9-0.9.el3.s390x.rpm seamonkey-mail-1.0.9-0.9.el3.s390x.rpm seamonkey-nspr-1.0.9-0.9.el3.s390.rpm seamonkey-nspr-1.0.9-0.9.el3.s390x.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.s390x.rpm seamonkey-nss-1.0.9-0.9.el3.s390.rpm seamonkey-nss-1.0.9-0.9.el3.s390x.rpm seamonkey-nss-devel-1.0.9-0.9.el3.s390x.rpm x86_64: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-1.0.9-0.9.el3.x86_64.rpm seamonkey-chat-1.0.9-0.9.el3.x86_64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.x86_64.rpm seamonkey-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.x86_64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.x86_64.rpm seamonkey-mail-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.x86_64.rpm Red Hat Desktop version 3: Source: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/seamonkey-1.0.9-0.9.el3.src.rpm i386: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-chat-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-devel-1.0.9-0.9.el3.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el3.i386.rpm seamonkey-mail-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el3.i386.rpm x86_64: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-1.0.9-0.9.el3.x86_64.rpm seamonkey-chat-1.0.9-0.9.el3.x86_64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.x86_64.rpm seamonkey-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.x86_64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.x86_64.rpm seamonkey-mail-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.x86_64.rpm Red Hat Enterprise Linux ES version 3: Source: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/seamonkey-1.0.9-0.9.el3.src.rpm i386: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-chat-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-devel-1.0.9-0.9.el3.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el3.i386.rpm seamonkey-mail-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el3.i386.rpm ia64: seamonkey-1.0.9-0.9.el3.ia64.rpm seamonkey-chat-1.0.9-0.9.el3.ia64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.ia64.rpm seamonkey-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.ia64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.ia64.rpm seamonkey-mail-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.ia64.rpm x86_64: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-1.0.9-0.9.el3.x86_64.rpm seamonkey-chat-1.0.9-0.9.el3.x86_64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.x86_64.rpm seamonkey-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.x86_64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.x86_64.rpm seamonkey-mail-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.x86_64.rpm Red Hat Enterprise Linux WS version 3: Source: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/seamonkey-1.0.9-0.9.el3.src.rpm i386: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-chat-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-devel-1.0.9-0.9.el3.i386.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.i386.rpm seamonkey-js-debugger-1.0.9-0.9.el3.i386.rpm seamonkey-mail-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-devel-1.0.9-0.9.el3.i386.rpm ia64: seamonkey-1.0.9-0.9.el3.ia64.rpm seamonkey-chat-1.0.9-0.9.el3.ia64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.ia64.rpm seamonkey-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.ia64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.ia64.rpm seamonkey-mail-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.ia64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.ia64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.ia64.rpm x86_64: seamonkey-1.0.9-0.9.el3.i386.rpm seamonkey-1.0.9-0.9.el3.x86_64.rpm seamonkey-chat-1.0.9-0.9.el3.x86_64.rpm seamonkey-debuginfo-1.0.9-0.9.el3.i386.rpm seamonkey-debuginfo-1.0.9-0.9.el3.x86_64.rpm seamonkey-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-dom-inspector-1.0.9-0.9.el3.x86_64.rpm seamonkey-js-debugger-1.0.9-0.9.el3.x86_64.rpm seamonkey-mail-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-1.0.9-0.9.el3.i386.rpm seamonkey-nspr-1.0.9-0.9.el3.x86_64.rpm seamonkey-nspr-devel-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-1.0.9-0.9.el3.i386.rpm seamonkey-nss-1.0.9-0.9.el3.x86_64.rpm seamonkey-nss-devel-1.0.9-0.9.el3.x86_64.rpm Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/seamonkey-1.0.9-9.el4.src.rpm i386: seamonkey-1.0.9-9.el4.i386.rpm seamonkey-chat-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-devel-1.0.9-9.el4.i386.rpm seamonkey-dom-inspector-1.0.9-9.el4.i386.rpm seamonkey-js-debugger-1.0.9-9.el4.i386.rpm seamonkey-mail-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-devel-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-devel-1.0.9-9.el4.i386.rpm ia64: seamonkey-1.0.9-9.el4.ia64.rpm seamonkey-chat-1.0.9-9.el4.ia64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.ia64.rpm seamonkey-devel-1.0.9-9.el4.ia64.rpm seamonkey-dom-inspector-1.0.9-9.el4.ia64.rpm seamonkey-js-debugger-1.0.9-9.el4.ia64.rpm seamonkey-mail-1.0.9-9.el4.ia64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.ia64.rpm seamonkey-nspr-devel-1.0.9-9.el4.ia64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.ia64.rpm seamonkey-nss-devel-1.0.9-9.el4.ia64.rpm ppc: seamonkey-1.0.9-9.el4.ppc.rpm seamonkey-chat-1.0.9-9.el4.ppc.rpm seamonkey-debuginfo-1.0.9-9.el4.ppc.rpm seamonkey-devel-1.0.9-9.el4.ppc.rpm seamonkey-dom-inspector-1.0.9-9.el4.ppc.rpm seamonkey-js-debugger-1.0.9-9.el4.ppc.rpm seamonkey-mail-1.0.9-9.el4.ppc.rpm seamonkey-nspr-1.0.9-9.el4.ppc.rpm seamonkey-nspr-devel-1.0.9-9.el4.ppc.rpm seamonkey-nss-1.0.9-9.el4.ppc.rpm seamonkey-nss-devel-1.0.9-9.el4.ppc.rpm s390: seamonkey-1.0.9-9.el4.s390.rpm seamonkey-chat-1.0.9-9.el4.s390.rpm seamonkey-debuginfo-1.0.9-9.el4.s390.rpm seamonkey-devel-1.0.9-9.el4.s390.rpm seamonkey-dom-inspector-1.0.9-9.el4.s390.rpm seamonkey-js-debugger-1.0.9-9.el4.s390.rpm seamonkey-mail-1.0.9-9.el4.s390.rpm seamonkey-nspr-1.0.9-9.el4.s390.rpm seamonkey-nspr-devel-1.0.9-9.el4.s390.rpm seamonkey-nss-1.0.9-9.el4.s390.rpm seamonkey-nss-devel-1.0.9-9.el4.s390.rpm s390x: seamonkey-1.0.9-9.el4.s390x.rpm seamonkey-chat-1.0.9-9.el4.s390x.rpm seamonkey-debuginfo-1.0.9-9.el4.s390.rpm seamonkey-debuginfo-1.0.9-9.el4.s390x.rpm seamonkey-devel-1.0.9-9.el4.s390x.rpm seamonkey-dom-inspector-1.0.9-9.el4.s390x.rpm seamonkey-js-debugger-1.0.9-9.el4.s390x.rpm seamonkey-mail-1.0.9-9.el4.s390x.rpm seamonkey-nspr-1.0.9-9.el4.s390.rpm seamonkey-nspr-1.0.9-9.el4.s390x.rpm seamonkey-nspr-devel-1.0.9-9.el4.s390x.rpm seamonkey-nss-1.0.9-9.el4.s390.rpm seamonkey-nss-1.0.9-9.el4.s390x.rpm seamonkey-nss-devel-1.0.9-9.el4.s390x.rpm x86_64: seamonkey-1.0.9-9.el4.x86_64.rpm seamonkey-chat-1.0.9-9.el4.x86_64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.x86_64.rpm seamonkey-devel-1.0.9-9.el4.x86_64.rpm seamonkey-dom-inspector-1.0.9-9.el4.x86_64.rpm seamonkey-js-debugger-1.0.9-9.el4.x86_64.rpm seamonkey-mail-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-devel-1.0.9-9.el4.x86_64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.x86_64.rpm seamonkey-nss-devel-1.0.9-9.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/seamonkey-1.0.9-9.el4.src.rpm i386: seamonkey-1.0.9-9.el4.i386.rpm seamonkey-chat-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-devel-1.0.9-9.el4.i386.rpm seamonkey-dom-inspector-1.0.9-9.el4.i386.rpm seamonkey-js-debugger-1.0.9-9.el4.i386.rpm seamonkey-mail-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-devel-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-devel-1.0.9-9.el4.i386.rpm x86_64: seamonkey-1.0.9-9.el4.x86_64.rpm seamonkey-chat-1.0.9-9.el4.x86_64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.x86_64.rpm seamonkey-devel-1.0.9-9.el4.x86_64.rpm seamonkey-dom-inspector-1.0.9-9.el4.x86_64.rpm seamonkey-js-debugger-1.0.9-9.el4.x86_64.rpm seamonkey-mail-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-devel-1.0.9-9.el4.x86_64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.x86_64.rpm seamonkey-nss-devel-1.0.9-9.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/seamonkey-1.0.9-9.el4.src.rpm i386: seamonkey-1.0.9-9.el4.i386.rpm seamonkey-chat-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-devel-1.0.9-9.el4.i386.rpm seamonkey-dom-inspector-1.0.9-9.el4.i386.rpm seamonkey-js-debugger-1.0.9-9.el4.i386.rpm seamonkey-mail-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-devel-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-devel-1.0.9-9.el4.i386.rpm ia64: seamonkey-1.0.9-9.el4.ia64.rpm seamonkey-chat-1.0.9-9.el4.ia64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.ia64.rpm seamonkey-devel-1.0.9-9.el4.ia64.rpm seamonkey-dom-inspector-1.0.9-9.el4.ia64.rpm seamonkey-js-debugger-1.0.9-9.el4.ia64.rpm seamonkey-mail-1.0.9-9.el4.ia64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.ia64.rpm seamonkey-nspr-devel-1.0.9-9.el4.ia64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.ia64.rpm seamonkey-nss-devel-1.0.9-9.el4.ia64.rpm x86_64: seamonkey-1.0.9-9.el4.x86_64.rpm seamonkey-chat-1.0.9-9.el4.x86_64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.x86_64.rpm seamonkey-devel-1.0.9-9.el4.x86_64.rpm seamonkey-dom-inspector-1.0.9-9.el4.x86_64.rpm seamonkey-js-debugger-1.0.9-9.el4.x86_64.rpm seamonkey-mail-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-devel-1.0.9-9.el4.x86_64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.x86_64.rpm seamonkey-nss-devel-1.0.9-9.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/seamonkey-1.0.9-9.el4.src.rpm i386: seamonkey-1.0.9-9.el4.i386.rpm seamonkey-chat-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-devel-1.0.9-9.el4.i386.rpm seamonkey-dom-inspector-1.0.9-9.el4.i386.rpm seamonkey-js-debugger-1.0.9-9.el4.i386.rpm seamonkey-mail-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-devel-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-devel-1.0.9-9.el4.i386.rpm ia64: seamonkey-1.0.9-9.el4.ia64.rpm seamonkey-chat-1.0.9-9.el4.ia64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.ia64.rpm seamonkey-devel-1.0.9-9.el4.ia64.rpm seamonkey-dom-inspector-1.0.9-9.el4.ia64.rpm seamonkey-js-debugger-1.0.9-9.el4.ia64.rpm seamonkey-mail-1.0.9-9.el4.ia64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.ia64.rpm seamonkey-nspr-devel-1.0.9-9.el4.ia64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.ia64.rpm seamonkey-nss-devel-1.0.9-9.el4.ia64.rpm x86_64: seamonkey-1.0.9-9.el4.x86_64.rpm seamonkey-chat-1.0.9-9.el4.x86_64.rpm seamonkey-debuginfo-1.0.9-9.el4.i386.rpm seamonkey-debuginfo-1.0.9-9.el4.x86_64.rpm seamonkey-devel-1.0.9-9.el4.x86_64.rpm seamonkey-dom-inspector-1.0.9-9.el4.x86_64.rpm seamonkey-js-debugger-1.0.9-9.el4.x86_64.rpm seamonkey-mail-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-1.0.9-9.el4.i386.rpm seamonkey-nspr-1.0.9-9.el4.x86_64.rpm seamonkey-nspr-devel-1.0.9-9.el4.x86_64.rpm seamonkey-nss-1.0.9-9.el4.i386.rpm seamonkey-nss-1.0.9-9.el4.x86_64.rpm seamonkey-nss-devel-1.0.9-9.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0413 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0415 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0417 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0418 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0419 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0591 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0592 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0593 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHq8QQXlSAg2UNWIIRAguvAJ0W4TQeH0tr1Ppyh0jn8dbQNl/RSACcCEi+ z+KHxfs4nlnSQ0OtHfIB6HE= =84Ju - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Critical: thunderbird security update Advisory ID: RHSA-2008:0105-02 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2008-0105.html Issue date: 2008-02-07 Updated on: 2008-02-27 CVE Names: CVE-2008-0304 CVE-2008-0412 CVE-2008-0413 CVE-2008-0415 CVE-2008-0418 CVE-2008-0419 CVE-2008-0420 CVE-2008-0591 CVE-2008-0592 CVE-2008-0593 ===================================================================== 1. Summary: Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 27th February 2008] The erratum text has been updated to include the details of additional issues that were fixed by these erratum packages, but which were not public at the time of release. No changes have been made to the packages. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64 3. Description: Mozilla Thunderbird is a standalone mail and newsgroup client. A heap-based buffer overflow flaw was found in the way Thunderbird processed messages with external-body Multipurpose Internet Message Extensions (MIME) types. A HTML mail message containing malicious content could cause Thunderbird to execute arbitrary code as the user running Thunderbird. (CVE-2008-0304) Several flaws were found in the way Thunderbird processed certain malformed HTML mail content. A HTML mail message containing malicious content could cause Thunderbird to crash, or potentially execute arbitrary code as the user running Thunderbird. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way Thunderbird displayed malformed HTML mail content. A HTML mail message containing specially-crafted content could trick a user into surrendering sensitive information. (CVE-2008-0420, CVE-2008-0591, CVE-2008-0593) A flaw was found in the way Thunderbird handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious HTML mail message to steal sensitive session data. Note: this flaw does not affect a default installation of Thunderbird. (CVE-2008-0418) Note: JavaScript support is disabled by default in Thunderbird; the above issues are not exploitable unless JavaScript is enabled. A flaw was found in the way Thunderbird saves certain text files. If a remote site offers a file of type "plain/text", rather than "text/plain", Thunderbird will not show future "text/plain" content to the user, forcing them to save those files locally to view the content. (CVE-2008-0592) Users of thunderbird are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/FAQ_58_10188 5. Bugs fixed (http://bugzilla.redhat.com/): 431732 - CVE-2008-0412 Mozilla layout engine crashes 431733 - CVE-2008-0413 Mozilla javascript engine crashes 431739 - CVE-2008-0415 Mozilla arbitrary code execution 431748 - CVE-2008-0418 Mozilla chrome: directory traversal 431749 - CVE-2008-0419 Mozilla arbitrary code execution 431751 - CVE-2008-0591 Mozilla information disclosure flaw 431752 - CVE-2008-0592 Mozilla text file mishandling 431756 - CVE-2008-0593 Mozilla URL token stealing flaw 435123 - CVE-2008-0304 thunderbird/seamonkey: MIME External-Body Heap Overflow Vulnerability 6. Package List: Red Hat Enterprise Linux AS version 4: Source: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm i386: thunderbird-1.5.0.12-8.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm ia64: thunderbird-1.5.0.12-8.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm ppc: thunderbird-1.5.0.12-8.el4.ppc.rpm thunderbird-debuginfo-1.5.0.12-8.el4.ppc.rpm s390: thunderbird-1.5.0.12-8.el4.s390.rpm thunderbird-debuginfo-1.5.0.12-8.el4.s390.rpm s390x: thunderbird-1.5.0.12-8.el4.s390x.rpm thunderbird-debuginfo-1.5.0.12-8.el4.s390x.rpm x86_64: thunderbird-1.5.0.12-8.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm i386: thunderbird-1.5.0.12-8.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm x86_64: thunderbird-1.5.0.12-8.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm i386: thunderbird-1.5.0.12-8.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm ia64: thunderbird-1.5.0.12-8.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm x86_64: thunderbird-1.5.0.12-8.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-8.el4.src.rpm i386: thunderbird-1.5.0.12-8.el4.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el4.i386.rpm ia64: thunderbird-1.5.0.12-8.el4.ia64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.ia64.rpm x86_64: thunderbird-1.5.0.12-8.el4.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el4.x86_64.rpm Red Hat Enterprise Linux Desktop (v. 5 client): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-1.5.0.12-8.el5.src.rpm i386: thunderbird-1.5.0.12-8.el5.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el5.i386.rpm x86_64: thunderbird-1.5.0.12-8.el5.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el5.x86_64.rpm RHEL Optional Productivity Applications (v. 5 server): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-1.5.0.12-8.el5.src.rpm i386: thunderbird-1.5.0.12-8.el5.i386.rpm thunderbird-debuginfo-1.5.0.12-8.el5.i386.rpm x86_64: thunderbird-1.5.0.12-8.el5.x86_64.rpm thunderbird-debuginfo-1.5.0.12-8.el5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0304 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0412 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0413 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0415 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0418 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0419 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0420 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0591 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0592 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0593 http://www.redhat.com/security/updates/classification/#critical 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2008 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFHxqUJXlSAg2UNWIIRAka5AJ0bqM+SC1HDBMm95a2n46PXm4HPmgCguR4W EbZ2+7EigkctGIna1GSkaiA= =WfZ1 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBR8d0Sih9+71yA2DNAQIP2wP/ShWd8iA0C5+GnY4qGBG1A5Booo8wQzPW oeqK8S0+6/147JdpDnj+IdU1jrc7MV0Og0485W0FcOOsCxIRkLgJW2q36m0vVL9v mvxGq2cNAUWx/CKhse9gaslhqXADEWIHGeWhsYAQPtFCT/tqs9O46DgGKRGNQxD3 y3dtbbR1w80= =eurB -----END PGP SIGNATURE-----