Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2015.2996
icedove security update
2 December 2015
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: icedove
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2015-7200 CVE-2015-7199 CVE-2015-7198
CVE-2015-7197 CVE-2015-7194 CVE-2015-7193
CVE-2015-7189 CVE-2015-7188 CVE-2015-7182
CVE-2015-7181 CVE-2015-4513 CVE-2015-4489
CVE-2015-4488 CVE-2015-4487 CVE-2015-4473
Reference: ASB-2015.0105
ASB-2015.0080
ESB-2015.2763
ESB-2015.2089
Original Bulletin:
http://www.debian.org/security/2015/dsa-3410
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3410-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 01, 2015 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : icedove
CVE ID : CVE-2015-4473 CVE-2015-4487 CVE-2015-4488 CVE-2015-4489
CVE-2015-4513 CVE-2015-7181 CVE-2015-7182 CVE-2015-7188
CVE-2015-7189 CVE-2015-7193 CVE-2015-7194 CVE-2015-7197
CVE-2015-7198 CVE-2015-7199 CVE-2015-7200
Multiple security issues have been found in Icedove, Debian's version of
the Mozilla Thunderbird mail client: Multiple memory safety errors,
integer overflows, buffer overflows and other implementation errors may
lead to the execution of arbitrary code or denial of service.
For the oldstable distribution (wheezy), these problems have been fixed
in version 38.4.0-1~deb7u1.
For the stable distribution (jessie), these problems have been fixed in
version 38.4.0-1~deb8u1.
For the unstable distribution (sid), these problems have been fixed in
version 38.4.0-1.
In addition enigmail has been updated to a release compatible with the
new ESR38 series.
We recommend that you upgrade your icedove packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWXhz4AAoJEBDCk7bDfE42ETAQAJZtNTxDX8iEb2pnAjVMoQLa
YM/8f7gi31GYDLIQU5PG/URe9je/XqSTzzYTvfk2Z3sdBxfQ6o3hxACe2QfNhmvZ
UItyv0chA1m+bDbyjDqSxm12RrRyGeRlv3FqSYFK1li44ylKkSHbxGNz+qPKNDrs
4Oo7kR5TQa9YptvfCC9u3iblYaQEWlcIs8BPE+iqAXCIeJmEs1ybA0VQfn6GE4Z0
lPHNCaucU+1iJCjyjYnjv2YIXQpFsOTr4wsr5p87koOCQYLezDQK/DTqw5E975YD
q+Rh6FTP/ooS2Qurf2JzBecO8PFk4vgUWl7X7BQQxirqzoAmOxFoaIV84XLWkxHW
/VsW6zhGOCPjblk19+4djXyEJvEiJYXbwsFLt7tKABVzWs1dH76xt4WLQad03zKi
0RFZ8U4U0qQOQz7+g96+V9CQsZjskZ6fvUC+vBKqb2Ya+v50CmQOCktDCA4hcQvB
35fgRXp61dXrMQGYWvPHnk96hPeW5CD+GOGstNZocP7lGP098ezBa7iy5dgCb+nB
mCdEjCO4UXH52QucvbaQlLH0FaixvK7c1sEY2Ptnsi1Kmk4uN3z1ReAOUDwAt0/O
VE18lL9hwF/9HiXBCVesCtvFB4/xuyRkWw+Pgz425h9bzHh4gSX89V1u5sLXrOAn
s2787wgiYB1VTJjZPnGB
=5Px+
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVl5r8X6ZAP0PgtI9AQJu7Q/+MRLXxNY5un478wQ697l56U/8+LY/JK7P
XJw1AVqS3q/HWP/XPYyYr0SMtDsZZeykCRMkNhMqhHvuomxX7ktVSiIfa2Mz2n84
6t8DWkX0uFAqaHIZMAD0UsEeX+/iDwj2Iiq+9UR4D5pEtSPrKqJS6wNQIVlLCCaz
90jcYLHfaLsyYatCB4DO60DgSEIkNeZ2vnI9PQubcaU7JKcPN3zZ2RSVGwG8/tlv
zwxkTneUZ9Q1G/1kVqjh2t1kazMKJkNB6V8Q7nJIoPzfVt1ZimOiuSMfFIhA3pXb
VcYWEID+8AbqjzzYYLdnstNASMH1nxHCTp5oy9tMym+IXkcMR5nI/f87SLpBrBE2
o5EBiW9zswGDucMyFkr9UtvKvYiUxKzuuILJ94DxhFlJemM8YmhRohDsX8cVPTKk
nBaKRdMHSX0ry8kOQssw7uy7k9PVXKY4nLqrjMET9kD7Fh7xgbOXEnMLV6lk8FFW
k0a2fIN8G1RU9y71FkBfVN8jhlvmEhZF74oGQlim++aUBv1kYcLXSXDltVfnyHh4
YWGAp3QyluYSjEgbjrLKFiCQu1+7USorSh48wRWfSjbUNKidhlZOFhvhlGJ7tny8
nKSxL1OOYQ1J+vwBdEBSi92DkPl7OIHl9NznTw9sd0ZP+pxNVbAoytI8OPJEIzPI
kF2TyFEcWzo=
=a7hh
-----END PGP SIGNATURE-----