WINDOWS CENTER: ubuntu-security-announce Digest, Vol 46, Issue 8

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-629-1] Thunderbird vulnerabilities (Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Thu, 24 Jul 2008 23:20:11 -0400
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-629-1] Thunderbird vulnerabilities
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20080725032011.GC3956@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-629-1 July 25, 2008
mozilla-thunderbird, thunderbird vulnerabilities
CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2802,
CVE-2008-2803, CVE-2008-2807, CVE-2008-2809, CVE-2008-2811
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1

Ubuntu 7.04:
mozilla-thunderbird 1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1

Ubuntu 7.10:
thunderbird 2.0.0.16+nobinonly-0ubuntu0.7.10.1

Ubuntu 8.04 LTS:
thunderbird 2.0.0.16+nobinonly-0ubuntu0.8.04.1

After a standard system upgrade you need to restart Thunderbird to
effect the necessary changes.

Details follow:

Various flaws were discovered in the browser engine. If a user had
Javascript enabled and were tricked into opening a malicious web
page, an attacker could cause a denial of service via application
crash, or possibly execute arbitrary code with the privileges of the
user invoking the program. (CVE-2008-2798, CVE-2008-2799)

It was discovered that Thunderbird would allow non-privileged XUL
documents to load chrome scripts from the fastload file if Javascript
was enabled. This could allow an attacker to execute arbitrary
Javascript code with chrome privileges. (CVE-2008-2802)

A flaw was discovered in Thunderbird that allowed overwriting trusted
objects via mozIJSSubScriptLoader.loadSubScript(). If a user had
Javascript enabled and was tricked into opening a malicious web page,
an attacker could execute arbitrary code with the privileges of the
user invoking the program. (CVE-2008-2803)

Daniel Glazman found that an improperly encoded .properties file in
an add-on can result in uninitialized memory being used. If a user
were tricked into installing a malicious add-on, Thunderbird may be
able to see data from other programs. (CVE-2008-2807)

John G. Myers discovered a weakness in the trust model used by
Thunderbird regarding alternate names on self-signed certificates.
If a user were tricked into accepting a certificate containing
alternate name entries, an attacker could impersonate another
server. (CVE-2008-2809)

A vulnerability was discovered in the block reflow code of
Thunderbird. If a user enabled Javascript, this vulnerability could
be used by an attacker to cause a denial of service via application
crash, or execute arbitrary code with the privileges of the user
invoking the program. (CVE-2008-2811)

A flaw was discovered in the browser engine. A variable could be made
to overflow causing Thunderbird to crash. If a user enable Javascript
and was tricked into opening a malicious web page, an attacker could
cause a denial of service or possibly execute arbitrary code with the
privileges of the user invoking the program. (CVE-2008-2785)

Mozilla developers audited the MIME handling code looking for similar
vulnerabilities to the previously fixed CVE-2008-0304, and changed
several function calls to use safer versions of string routines.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1.diff.gz
Size/MD5: 457638 73c477206c17445c1fa665cc0ce1f181
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1.dsc
Size/MD5: 1680 0fe3944fd3fef91bd428cbd56c230554
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d.orig.tar.gz
Size/MD5: 37543054 34cc52af5fe915d806dca23003125786

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_amd64.deb
Size/MD5: 3593468 b0c4d143fa925281414f0beaf69783e6
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_amd64.deb
Size/MD5: 194946 6830ed825a951517d357f6dd85781567
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_amd64.deb
Size/MD5: 60194 e162622559d411f31f48ed60daa3ba33
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_amd64.deb
Size/MD5: 12117020 39d4685f83426a2d9249cb6a7afa7535

i386 architecture (x86 compatible Intel/AMD):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_sparc.deb
Size/MD5: 3588816 94aee0babf4601a8cc4a272e8bbc6299
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_sparc.deb
Size/MD5: 189130 0b2dc3142ad9a9f52b05ed51df002d14
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_sparc.deb
Size/MD5: 57196 86959934b9ab079465c99e8ed62cfbda
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.6.06.1_sparc.deb
Size/MD5: 10864344 47dedc0c9cc016c043e8f90488bc97eb

Updated packages for Ubuntu 7.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1.diff.gz
Size/MD5: 127581 acb24c37c3d02dd526c9097aa747d7fa
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1.dsc
Size/MD5: 1680 57ebe6d74158120e68635bfad40c6de9
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d.orig.tar.gz
Size/MD5: 37543054 34cc52af5fe915d806dca23003125786

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_amd64.deb
Size/MD5: 3593698 61f837924231d01685365741382a6ac4
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_amd64.deb
Size/MD5: 195584 6313be097a0eb8374269dd1d5127da90
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_amd64.deb
Size/MD5: 60706 d0f12e08abe326e34ec8570be8cb6af6
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_amd64.deb
Size/MD5: 12213806 edaebf43387b82272be869fb121fb27d

i386 architecture (x86 compatible Intel/AMD):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_sparc.deb
Size/MD5: 3590386 347dc2de7068b9ec4f8cb7c258de4550
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_sparc.deb
Size/MD5: 190034 fcd4a1dd483d3ea1bcfafc49f857db2f
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_sparc.deb
Size/MD5: 57744 de26d6aaf140200463a432f9e0b0fafa
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.13+1.5.0.15~prepatch080614d-0ubuntu0.7.04.1_sparc.deb
Size/MD5: 11163080 575915c689799019455e5488aaa6e5f5

Updated packages for Ubuntu 7.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1.diff.gz
Size/MD5: 125662 c0b6b2aed6618b5f74df32f396a0b64d
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1.dsc
Size/MD5: 2313 4c877877e18115f259011c194314f97d
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly.orig.tar.gz
Size/MD5: 37848872 685a0603ea0cc9788607db3051585c95

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_all.deb
Size/MD5: 60282 908487ed5ee6c65a17ce0438bafb8044
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_all.deb
Size/MD5: 60268 e1f113b9c24358563f1e5de4853dfb71

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_amd64.deb
Size/MD5: 3776470 44b47a6d1fc30b2bf1e0967d2f7e6d5a
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.7.10.1_amd64.deb
Size/MD5: 85456 e74490be6109f247a7588896cc908d06
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_amd64.deb
Size/MD5: 12422462 85edbea8c87ea6f36628c42fbb7111cd

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_i386.deb
Size/MD5: 3764864 5720ca3309420ef466a476099f342c46
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.7.10.1_i386.deb
Size/MD5: 80788 b82715a2517eba24387a3daa37e11c23
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_i386.deb
Size/MD5: 10992746 ca5654c9c456ff81fbcd012bb5e6e2b9

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_lpia.deb
Size/MD5: 3762270 cfc22bb7eceed86b5f4812b294c3d212
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.7.10.1_lpia.deb
Size/MD5: 80478 8df12ac8e92b3363108d500d77ce8fb3
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_lpia.deb
Size/MD5: 10831262 76e8a6df9fcd0af2217d9cceb175e209

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_powerpc.deb
Size/MD5: 3780296 181c69adfe5581593563474c5b9afa6a
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.7.10.1_powerpc.deb
Size/MD5: 83848 47e0d48c82b856934f8203368ed9f2e1
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_powerpc.deb
Size/MD5: 12267962 1c1b0b2a16c4646ae058c33079a603b6

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.7.10.1_sparc.deb
Size/MD5: 3762238 6a1b3ba170e21090519cb5fe968fc2c8
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.7.10.1_sparc.deb
Size/MD5: 80228 ee44b1f994a4dd68164c9ae8b9935e00
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.7.10.1_sparc.deb
Size/MD5: 11262024 b8269b24e6e8871cacfc805ebe3a8f7c

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1.diff.gz
Size/MD5: 129220 6715132a5a51ec41e5caf7825ea5280b
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1.dsc
Size/MD5: 2311 b9bc842ede114d04e30859784ec0ac8f
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly.orig.tar.gz
Size/MD5: 37848872 685a0603ea0cc9788607db3051585c95

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_all.deb
Size/MD5: 60418 5e9e8458e07caf7ac3f70ce458ac03a0
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/mozilla-thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_all.deb
Size/MD5: 60406 4bb82dac196e507e3af44810b7f4a7a0

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 3777100 bd2828d3036e93c1f628f535e80d86b9
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 85294 dcd00b5cf7295d99414e62d3d2f28926
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_amd64.deb
Size/MD5: 12403016 024d7b93d68505878888fc8bc2a92818

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 3765088 9f2b5b5420228f12b603f31b447867f0
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 80712 6c717ceb8fa8c7980d39f4c05f685411
http://security.ubuntu.com/ubuntu/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_i386.deb
Size/MD5: 10976954 ff23083ceeb1c2b30962ccde4f5dd08b

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 3762860 52d5dd0faa096a1cfb389fc589c46bea
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 80438 a8e539ae570a5c501ff16dcdf6863988
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_lpia.deb
Size/MD5: 10821994 15e787453c8868288ba8e63cf4a1f8b1

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 3780896 0a45ba96633b2b220895fea1592f55b1
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 83694 03359691f2dee29979cc5ed508b9d9f8
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_powerpc.deb
Size/MD5: 12250278 3a6ed4754c6e63758a743aabdcca6d47

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-dev_2.0.0.16+nobinonly-0ubuntu0.8.04.1_sparc.deb
Size/MD5: 3762700 7e9a0352360a8b33ab7a20acb733ee05
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird-gnome-support_2.0.0.16+nobinonly-0ubuntu0.8.04.1_sparc.deb
Size/MD5: 80146 c34186f45e9adaf8334cc507095e4610
http://ports.ubuntu.com/pool/main/t/thunderbird/thunderbird_2.0.0.16+nobinonly-0ubuntu0.8.04.1_sparc.deb
Size/MD5: 11248406 50a69b5092528dd02fd51a92be7cd4c0

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20080724/b3f46b94/attachment-0001.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 46, Issue 8
*******************************************************

News

Friday, July 25, 2008

ubuntu-security-announce Digest, Vol 46, Issue 8

No comments:

WINDOWS CENTER

Blog Archive