-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1191-1 security@debian.org http://www.debian.org/security/ Martin Schulze October 5th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : mozilla-thunderbird Vulnerability : several Problem type : remote Debian-specific: no CVE IDs : CVE-2006-2788 CVE-2006-4340 CVE-2006-4565 CVE-2006-4566 CVE-2006-4568 CVE-2006-4570 CVE-2006-4571 BugTraq ID : 20042 Several security related problems have been discovered in Mozilla and derived products such as Mozilla Thunderbird. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2006-2788 Fernando Ribeiro discovered that a vulnerability in the getRawDER functionallows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code. CVE-2006-4340 Daniel Bleichenbacher recently described an implementation error in RSA signature verification that cause the application to incorrectly trust SSL certificates. CVE-2006-4565, CVE-2006-4566 Priit Laes reported that that a JavaScript regular expression can trigger a heap-based buffer overflow which allows remote attackers to cause a denial of service and possibly execute arbitrary code. CVE-2006-4568 A vulnerability has been discovered that allows remote attackers to bypass the security model and inject content into the sub-frame of another site. CVE-2006-4570 Georgi Guninski demonstrated that even with JavaScript disabled in mail (the default) an attacker can still execute JavaScript when a mail message is viewed, replied to, or forwarded. CVE-2006-4571 Multiple unspecified vulnerabilities in Firefox, Thunderbird and SeaMonkey allow remote attackers to cause a denial of service, corrupt memory, and possibly execute arbitrary code. For the stable distribution (sarge) these problems have been fixed in version 1.0.2-2.sarge1.0.8c.1. For the unstable distribution (sid) these problems have been fixed in version 1.5.0.7-1. We recommend that you upgrade your Mozilla Thunderbird packages. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given at the end of this advisory: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1.dsc Size/MD5 checksum: 1003 d7261fba347b9876e873f1d424e60190 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1.diff.gz Size/MD5 checksum: 519315 066ed351050722c36274e3e837fd174f http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2.orig.tar.gz Size/MD5 checksum: 33288906 806175393a226670aa66060452d31df4 Alpha architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_alpha.deb Size/MD5 checksum: 12855288 285e55a20445ea5dffe79de01baf788c http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_alpha.deb Size/MD5 checksum: 3280106 0206d9fe08e3da2d4bf919c6b2b54ec7 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_alpha.deb Size/MD5 checksum: 152092 c5c984f0f11f94cb263f5bbef367de09 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_alpha.deb Size/MD5 checksum: 33520 ed7e6d825f630da666e07914527f2c75 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_alpha.deb Size/MD5 checksum: 89492 1e9ed565915dc4327e444ad999cc5daa AMD64 architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_amd64.deb Size/MD5 checksum: 12258904 f40f86252184ce7360b2b9d1e58cef8f http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_amd64.deb Size/MD5 checksum: 3281164 e4e2160d22d4721508f1762804b3b18b http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_amd64.deb Size/MD5 checksum: 151124 a72d17f827929c9189f9ba96ff73c7a1 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_amd64.deb Size/MD5 checksum: 33512 bbe0fe4a7e56a138c220790ab9de97a6 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_amd64.deb Size/MD5 checksum: 89350 f2b7e1d1d4eb5f1abb2522ddbdb46ff5 ARM architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_arm.deb Size/MD5 checksum: 10345146 4c171699433072d443eb7b35a2550fd2 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_arm.deb Size/MD5 checksum: 3272118 a52ad3d2cd1806e936374537e135d7db http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_arm.deb Size/MD5 checksum: 143266 9dedbe9b5f45727a93cfccb5c99bf371 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_arm.deb Size/MD5 checksum: 33522 14d1c0d0af46731075ea7c35c2900258 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_arm.deb Size/MD5 checksum: 81318 81219b4c82896fab12427e42df1b2760 HP Precision architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_hppa.deb Size/MD5 checksum: 13570024 3a62ee11075402dfad030e2ede937191 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_hppa.deb Size/MD5 checksum: 3285124 e9cadee2d32b2bcb56b1278043e97da4 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_hppa.deb Size/MD5 checksum: 153296 3fecaa707002afb1ba6854da724ad132 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_hppa.deb Size/MD5 checksum: 33520 83e537b9aff4d44fd958043298a1d7f2 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_hppa.deb Size/MD5 checksum: 97390 c3ceeedcf00d99d34c7b5f424da7da63 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_i386.deb Size/MD5 checksum: 11568436 af1de65bd715970c4432149aec80b2a2 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_i386.deb Size/MD5 checksum: 3507870 5dab89db24f1443fe782dc931f4ee0af http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_i386.deb Size/MD5 checksum: 146732 bc52082cd1ab0f026c401204cd63b4a7 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_i386.deb Size/MD5 checksum: 33518 5d3c9700cce7b9c0261c246ed7b8afd4 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_i386.deb Size/MD5 checksum: 88084 e244c9c8b7224814774bef13f4213d4e Intel IA-64 architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_ia64.deb Size/MD5 checksum: 14628630 07bfcc171f449b86b9d62f903e29d506 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_ia64.deb Size/MD5 checksum: 3291260 d7186841974796f8f90be26700801a95 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_ia64.deb Size/MD5 checksum: 155452 e17eb664e56fcc0809dd36580f92cc1a http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_ia64.deb Size/MD5 checksum: 33514 fc890529fdea5526a05ffd16b96f5956 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_ia64.deb Size/MD5 checksum: 107220 eb93528d586b050ecc3b60742b4fa344 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_m68k.deb Size/MD5 checksum: 10794842 fa716b92e3c7a9d67fad6fd453c78bb4 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_m68k.deb Size/MD5 checksum: 3271690 d95eb910dd6d38de41c17fcb6b1c4696 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_m68k.deb Size/MD5 checksum: 145054 2b7570676e15cea809905c442f91b5e0 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_m68k.deb Size/MD5 checksum: 33550 3db6c520d1c489fb4e17501d19dececf http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_m68k.deb Size/MD5 checksum: 82556 32d25c11844a48ed963e3c5c51ff34fc Big endian MIPS architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_mips.deb Size/MD5 checksum: 11948708 4f58ce9668da6a12b823edaa3c8b35b3 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_mips.deb Size/MD5 checksum: 3279410 e639b2bf43eda95d3ca3bb0b9aec6df7 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_mips.deb Size/MD5 checksum: 148042 cb6ee4a9bd4dec3166e48e356b9c3465 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_mips.deb Size/MD5 checksum: 33524 2765555b00f4ed717b34e98c5c0d9c02 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_mips.deb Size/MD5 checksum: 84748 0e934e90bb6bd47c7500fd665728ba27 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_mipsel.deb Size/MD5 checksum: 11817078 4239077894c74444d33063229dd847df http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_mipsel.deb Size/MD5 checksum: 3280416 ac165850436e63818da8fffe134628d1 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_mipsel.deb Size/MD5 checksum: 147600 ae6d7ff1b34dddab3d0c18d6e38bc77b http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_mipsel.deb Size/MD5 checksum: 33518 27bed1b95a4e34a291c7e67c6a9fdd37 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_mipsel.deb Size/MD5 checksum: 84650 173fefc8b58b15398b3cccad2c812495 PowerPC architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_powerpc.deb Size/MD5 checksum: 10912494 d13ec5b97f5fde0795e5f762330756f6 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_powerpc.deb Size/MD5 checksum: 3270108 dbd7eb3154db4a379fcfcda6b7d414b9 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_powerpc.deb Size/MD5 checksum: 145048 b9ab45845f58fb064d7d1ae449481db9 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_powerpc.deb Size/MD5 checksum: 33526 b5e07e26d215581b4cc0fea6d71beaf3 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_powerpc.deb Size/MD5 checksum: 81478 b57b8038afbfd5490a6cf847e740ab60 IBM S/390 architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_s390.deb Size/MD5 checksum: 12705708 68195861caccd07a18a379ffe2e88403 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_s390.deb Size/MD5 checksum: 3280614 38dec996622a4e1762a1ef683bba9c43 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_s390.deb Size/MD5 checksum: 151436 b54ba7420653e63746d019b979f3ae76 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_s390.deb Size/MD5 checksum: 33516 e24dafe27c103a8d40de9a905b052311 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_s390.deb Size/MD5 checksum: 89290 9daa1eb634834e02aefde0a594bcd0f9 Sun Sparc architecture: http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.8c.1_sparc.deb Size/MD5 checksum: 11181284 adedd4c6302ddb868a531810d226143a http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.8c.1_sparc.deb Size/MD5 checksum: 3275816 c38922ec47674939277e6984f87c0eb4 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.8c.1_sparc.deb Size/MD5 checksum: 144702 9183a627463aa564a0313d4d361d22f3 http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.8c.1_sparc.deb Size/MD5 checksum: 33528 5f87736faa9ee0a9b10e29c48280798a http://security.debian.org/pool/updates/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.8c.1_sparc.deb Size/MD5 checksum: 83122 72966880dc02a1b472dcac7b1404fa58 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iD8DBQFFJNsFW5ql+IAeqTIRAgeZAJ0dYXyy9QKfcADcFekhEP7n0hfqeACgpro4 H5iKBfGUezJNoEbseNfM8+Q= =Dv+0 -----END PGP SIGNATURE-----