Date: Sun, 11 Apr 2010 17:42:48 -0500
From: Jamie Strandboge <jamie@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-927-3] Thunderbird regression

===========================================================
Ubuntu Security Notice USN-927-3             April 11, 2010
thunderbird regression
https://launchpad.net/bugs/559918
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  thunderbird                     2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2

After a standard system upgrade you need to restart Thunderbird to effect
the necessary changes.

Details follow:

USN-927-1 fixed vulnerabilities in NSS. Due to upstream changes in NSS
3.12.6, Thunderbird would be unable to initialize the security component
and connect with SSL/TLS if the old libnss3-0d transition package was
installed. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 Marsh Ray and Steve Dispensa discovered a flaw in the TLS and SSLv3
 protocols. If an attacker could perform a man in the middle attack at the
 start of a TLS connection, the attacker could inject arbitrary content at
 the beginning of the user's session. This update adds support for the new
 new renegotiation extension and will use it when the server supports it.


Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2.diff.gz
      Size/MD5:   134402 4f55d904c22d00c1423fcdf778237df3
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2.dsc
      Size/MD5:     2362 5fbf0ab8c09988462ffad652d5724ec1
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly.orig.tar.gz
      Size/MD5: 36467375 a952c9895cc90b89f160c4b3694de834

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_all.deb
      Size/MD5:    62220 92dafa6f0a04d064a0c96199ce9faef6
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_all.deb
      Size/MD5:    62208 0e785915e1142f3bb25573651cd2a76b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
      Size/MD5:  3738538 5d00b51452f0a5ada7aa859d4e073536
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
      Size/MD5:    62562 5f4e424d427833b1490f28ec3a5073e5
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_amd64.deb
      Size/MD5: 12558830 ea6aea8f8aea5a22927a33fa3d49e69a

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
      Size/MD5:  3722604 00383caa32265845d431ba1c41370e51
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
      Size/MD5:    62562 72a659110cc3ce2a8321c0a2f9475de6
    http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_i386.deb
      Size/MD5: 11177860 de57f8a625ed43983853b3f1f1bbf567

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
      Size/MD5:  3720600 dd62f203c661fdf8da663f6c5d53445e
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
      Size/MD5:    62564 79e32137bc4bc26ab33b3fd9c8db6067
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_lpia.deb
      Size/MD5: 11025166 649235af94da5615278de12fd8ea4005

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
      Size/MD5:  3729730 a90d7dd672e198674a46a4c0f9e9dba1
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
      Size/MD5:    62562 6137b40f8bf9012911479830602ef04d
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_powerpc.deb
      Size/MD5: 12297146 45dae3dadc5ab90e41dc8e61ca30f67b

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
      Size/MD5:  3725800 0e080e766d6631585cd3d3569e4c1d56
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
      Size/MD5:    62568 f4ad15ef0907e0a3efa47595a9e6f33f
    http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.24+build1+nobinonly-0ubuntu0.9.10.2_sparc.deb
      Size/MD5: 11193490 9eae6654fbe5ff0a7b3bbc5521c4f60e




Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists