bugtraq - rPSA-2007-0157-1 firefox thunderbird

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <46bc6b0d.XUL0Pgss3KjF/Iqq%announce-noreply@rpath.com>
Date: Fri, 10 Aug 2007 09:41:33 -0400
From: rPath Update Announcements <announce-noreply@...th.com>
To: security-announce@...ts.rpath.com,
	update-announce@...ts.rpath.com
Cc: full-disclosure@...ts.grok.org.uk, vulnwatch@...nwatch.org,
	bugtraq@...urityfocus.com, lwn@....net
Subject: rPSA-2007-0157-1 firefox thunderbird

rPath Security Advisory: 2007-0157-1
Published: 2007-08-10
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
    Indirect User Non-deterministic Unauthorized Access
Updated Versions:
    firefox=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1
    thunderbird=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1

References:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845
    https://issues.rpath.com/browse/RPL-1600

Description:
    Previous versions of the firefox and thunderbird packages are
    vulnerable to multiple attacks.  One is a weakness that makes it hard
    for add-ons to defend against a user-assisted privilege escalation
    attack; the other can in some cases allow a user-assisted attacker
    to run possibly arbitrary programs as the user running firefox
    or thunderbird.
    
    As the 1.5.0.x versions of firefox and thunderbird are no longer
    being maintained, the new versions of the firefox and thunderbird
    packages are new major versions.  Of particular note, some firefox
    add-ons that are no longer maintained may no longer function with
    the new version of firefox.

Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html