Sinopsis

seamonkey security update

Tipo/Gravedad

Security Advisory: Critical

Tema:

Updated seamonkey packages that fix several security bugs are now available
for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Descripción

SeaMonkey is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.

Two flaws were found in the way SeaMonkey processed certain regular
expressions. A malicious web page could crash the browser or possibly
execute arbitrary code as the user running SeaMonkey. (CVE-2006-4565,
CVE-2006-4566)

A flaw was found in the handling of Javascript timed events. A malicious
web page could crash the browser or possibly execute arbitrary code as the
user running SeaMonkey. (CVE-2006-4253)

Daniel Bleichenbacher recently described an implementation error in RSA
signature verification. For RSA keys with exponent 3 it is possible for an
attacker to forge a signature that would be incorrectly verified by the NSS
library. SeaMonkey as shipped trusts several root Certificate Authorities
that use exponent 3. An attacker could have created a carefully crafted
SSL certificate which be incorrectly trusted when their site was visited by
a victim. (CVE-2006-4340)

SeaMonkey did not properly prevent a frame in one domain from injecting
content into a sub-frame that belongs to another domain, which facilitates
website spoofing and other attacks (CVE-2006-4568)

A flaw was found in SeaMonkey Messenger triggered when a HTML message
contained a remote image pointing to a XBL script. An attacker could have
created a carefully crafted message which would execute Javascript if
certain actions were performed on the email by the recipient, even if
Javascript was disabled. (CVE-2006-4570)

A number of flaws were found in SeaMonkey. A malicious web page could
crash the browser or possibly execute arbitrary code as the user running
SeaMonkey. (CVE-2006-4571)

Users of SeaMonkey or Mozilla are advised to upgrade to this update, which
contains SeaMonkey version 1.0.5 that corrects these issues.

For users of Red Hat Enterprise Linux 2.1 this SeaMonkey update obsoletes
Galeon. Galeon was a web browser based on the Mozilla Gecko layout engine.

Solución

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If you experience problems upgrading your seamonkey packages, please run
the following command to remove the problematic mozilla packages, and
re-run up2date:

rpm -e mozilla-nss mozilla-nspr

Productos afectados

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Correcciones

• BZ - 206429 - CVE-2006-4340 Various SeaMonkey security issues (CVE-2006-4253 CVE-2006-4565 CVE-2006-4566 CVE-2006-4568 CVE-2006-4570 CVE-2006-4571)

CVE

• CVE-2006-4253
• CVE-2006-4565
• CVE-2006-4566
• CVE-2006-4340
• CVE-2006-4571
• CVE-2006-4568
• CVE-2006-4570

Referencias

• http://www.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
devhelp-0.10-0.4.el4.ppc.rpm	SHA-256: 6ba79643651ba84f9bf9638509cbe1d5b3bd5fb6b6e94ccdad4769fa3d99e1ea
devhelp-devel-0.10-0.4.el4.ppc.rpm	SHA-256: ddd375035d1a84c4770d51410a0865f76b7f96775f8a17f81231ee3df6ee5fe7
seamonkey-1.0.5-0.1.el4.ppc.rpm	SHA-256: cfbe0ad59c5573f4db81ecb39636b55844bb97a43bcc016dc8665c028aa66ccd
seamonkey-chat-1.0.5-0.1.el4.ppc.rpm	SHA-256: a78f2df98fcba4682f2cd3e92c0e24ac49a4539227ab068484a029f478e92c6f
seamonkey-devel-1.0.5-0.1.el4.ppc.rpm	SHA-256: 211d79292208f134f2b0e2caa0336f9d3a0aa0fd9e9e3ebecbeb82b1937bb1d3
seamonkey-dom-inspector-1.0.5-0.1.el4.ppc.rpm	SHA-256: 7ab476ed62b164ac950ae84f93165841b21e8a20cbb023b719ebf43930927fc4
seamonkey-js-debugger-1.0.5-0.1.el4.ppc.rpm	SHA-256: ec5ed72599d93c5349831d1561ceb9590c01bcb78f1eab8e9aeaefd3b40d1aae
seamonkey-mail-1.0.5-0.1.el4.ppc.rpm	SHA-256: 59b18d75dc9b4070200dcecbceb9d9aedb324717f9ae9bd9e9125e1243e3e091
seamonkey-nspr-1.0.5-0.1.el4.ppc.rpm	SHA-256: e0e1c79ccad0b2591d14cbfb6289f6cbb3797b8e579207cfead84d070a961159
seamonkey-nspr-devel-1.0.5-0.1.el4.ppc.rpm	SHA-256: ff102b70f7dfd1ce77c79e8bdea572dc28630ec4f42381b5c9298d43d139dd6e
seamonkey-nss-1.0.5-0.1.el4.ppc.rpm	SHA-256: 85e8b505e25b7af5d688c96c4929c6eb5d032260844a1fa8b570120a555b35ec
seamonkey-nss-devel-1.0.5-0.1.el4.ppc.rpm	SHA-256: 3a83c4edd675aa98ac51574264a8d10dfbb03a0d7ea1c67e21960c712f7f8443