bugtraq - FLEA-2007-0027-1: thunderbird

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 20 Jun 2007 11:49:51 -0400
From: Foresight Linux Essential Announcement Service <foresight-security-noreply@...esightlinux.org>
To: foresight-security-announce@...ts.rpath.org
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	lwn@....net
Subject: FLEA-2007-0027-1: thunderbird 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Foresight Linux Essential Advisory: 2007-0027-1
Published: 2007-06-20

Rating: Major

Updated Versions:
    thunderbird=/conary.rpath.com@rpl:devel//foresight.rpath.org@fl:1-devel//1/2.0.0.4-0.1-1
    group-dist=/foresight.rpath.org@fl:1-devel//1/1.3-0.6-5

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2867
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2868
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558
    https://issues.rpath.com/browse/RPL-1425

Description:
    Previous versions of the thunderbird package are vulnerable to multiple
    vulnerabilities in the layout and javascript engines which are known to
    cause a denial-of-service (crash) and could potentially be exploited to
    execute arbitrary attacker-provided code. In addition, a man-in-the-middle
    attack which could be used to steal the first 3 characters of a passphrase
    when using APOP has been fixed. 
    
- ---

Copyright 2007 Foresight Linux Project
This file is distributed under the terms of the MIT License.
A copy is available at http://www.foresightlinux.org/permanent/mit-license.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.4 (GNU/Linux)

iQIVAwUBRnlMkdfwEn07iAtZAQLXaRAAxjFW1+ns4U7DnZERyAdyWFVMILwe3aGW
TjZzpo9SR1T3cGXTCxRgLci/cmS/mHi1Pob7IDXau2/45rYe32AKMf+4hKOyaOyR
Aqc6EmZfYa4smBTtULJiFVPvEmeZU+wBk481XZyjOuug/iCa0oRdo+z6sG5doLXZ
c57jAeoZm+DNrXV1Q3DVL/rE2TLd5KIjctxLysgBrnzdLw5wdv7xSho6+NJjGXe0
LqPY7BPdoAiMLUGTFc/BWAv0YZ1L7k60QpexRlgVvXAJLiirElKCDe0KYv9jIFxb
TJRHrNKAWafyHThYRnKzf/qC2yLy1qBqfbnnwTtJjhAHO/FbpHsMYBeU1H+gFeJM
f8cOEJCpypax85lQkFK9uB+WkeNN04gM+zZHzdiwBfhAJnDOAbL19C/W/EHvhmjM
NMDnPtIsU7xsLo4W8GhZkq8MZ3pULiVK+fdm2VnqQ8keuTCj5e7hp8ra3aKtuF1C
JCISzrrTvw1FC+g1D1HxoUun6/zkGx2zIPPzkK4MBH5kwAvqADhfCx5hqTJrmGri
ET5S0n1UqrJ8rSa8Mmb/mHGaSPPRRE/h10fKkZWgknbjhQpLDTsPGWLMN15GtdyC
6lMX4ykpcUXdUBWop7HVerPk2x3i91VGS0ymPHLana5CKw3fZFpAmGyQzgKdctks
yXSZXBFca08=
=CjxU
-----END PGP SIGNATURE-----