| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20100411224248.GA20501@severus.strandboge.com>
Date: Sun, 11 Apr 2010 17:42:48 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-927-3] Thunderbird regression
===========================================================
Ubuntu Security Notice USN-927-3 April 11, 2010
thunderbird regression
https://launchpad.net/bugs/559918
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 9.10:
thunderbird 2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2
After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.
Details follow:
USN-927-1 fixed vulnerabilities in NSS. Due to upstream changes in NSS
3.12.6, Thunderbird would be unable to initialize the security component
and connect with SSL/TLS if the old libnss3-0d transition package was
installed. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
protocols. If an attacker could perform a man in the middle attack at the
start of a TLS connection, the attacker could inject arbitrary content at
the beginning of the user's session. This update adds support for the new
new renegotiation extension and will use it when the server supports it.
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2.diff.gz
Size/MD5: 134402 4f55d904c22d00c1423fcdf778237df3
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2.dsc
Size/MD5: 2362 5fbf0ab8c09988462ffad652d5724ec1
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly.orig.tar.gz
Size/MD5: 36467375 a952c9895cc90b89f160c4b3694de834
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_all.deb
Size/MD5: 62220 92dafa6f0a04d064a0c96199ce9faef6
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_all.deb
Size/MD5: 62208 0e785915e1142f3bb25573651cd2a76b
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
Size/MD5: 3738538 5d00b51452f0a5ada7aa859d4e073536
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
Size/MD5: 62562 5f4e424d427833b1490f28ec3a5073e5
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
Size/MD5: 12558830 ea6aea8f8aea5a22927a33fa3d49e69a
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
Size/MD5: 3722604 00383caa32265845d431ba1c41370e51
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
Size/MD5: 62562 72a659110cc3ce2a8321c0a2f9475de6
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
Size/MD5: 11177860 de57f8a625ed43983853b3f1f1bbf567
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
Size/MD5: 3720600 dd62f203c661fdf8da663f6c5d53445e
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
Size/MD5: 62564 79e32137bc4bc26ab33b3fd9c8db6067
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
Size/MD5: 11025166 649235af94da5615278de12fd8ea4005
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
Size/MD5: 3729730 a90d7dd672e198674a46a4c0f9e9dba1
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
Size/MD5: 62562 6137b40f8bf9012911479830602ef04d
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
Size/MD5: 12297146 45dae3dadc5ab90e41dc8e61ca30f67b
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
Size/MD5: 3725800 0e080e766d6631585cd3d3569e4c1d56
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
Size/MD5: 62568 f4ad15ef0907e0a3efa47595a9e6f33f
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
Size/MD5: 11193490 9eae6654fbe5ff0a7b3bbc5521c4f60e
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists