Synopsis

Critical: thunderbird security update

Type/Severity

Security Advisory: Critical

Topic

Updated thunderbird packages that fix several security bugs are now
available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way Thunderbird processes certain malformed
Javascript code. A malicious HTML mail message could cause the execution of
Javascript code in such a way that could cause Thunderbird to crash or
execute arbitrary code as the user running Thunderbird. (CVE-2006-5463,
CVE-2006-5747, CVE-2006-5748)

Several flaws were found in the way Thunderbird renders HTML mail messages.
A malicious HTML mail message could cause the mail client to crash or
possibly execute arbitrary code as the user running Thunderbird.
(CVE-2006-5464)

A flaw was found in the way Thunderbird verifies RSA signatures. For RSA
keys with exponent 3 it is possible for an attacker to forge a signature
that would be incorrectly verified by the NSS library. Thunderbird as
shipped trusts several root Certificate Authorities that use exponent 3. An
attacker could have created a carefully crafted SSL certificate which would
be incorrectly trusted when their site was visited by a victim. This flaw
was previously thought to be fixed in Thunderbird 1.5.0.7, however Ulrich
Kuehn discovered the fix was incomplete (CVE-2006-5462)

Users of Thunderbird are advised to upgrade to this update, which contains
Thunderbird version 1.5.0.8 that corrects these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 214450 - CVE-2006-5462 Multiple thunderbird vulnerabilities (CVE-2006-5463, CVE-2006-5464, CVE-2006-5747, CVE-2006-5748)

CVEs

• CVE-2006-5462
• CVE-2006-5463
• CVE-2006-5748
• CVE-2006-5747
• CVE-2006-5464

References

• http://www.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server 4

SRPM
thunderbird-1.5.0.8-0.1.el4.src.rpm	SHA-256: caba3b5d5f25a1ed341fb3424a6904dfb02f38f4e30eca2b522bc10a4f5d51c4
x86_64
thunderbird-1.5.0.8-0.1.el4.x86_64.rpm	SHA-256: 779d74d74deeaf77769e793d36e0654af5165939b896bae83daad4e93786fb3b
thunderbird-1.5.0.8-0.1.el4.x86_64.rpm	SHA-256: 779d74d74deeaf77769e793d36e0654af5165939b896bae83daad4e93786fb3b
ia64
thunderbird-1.5.0.8-0.1.el4.ia64.rpm	SHA-256: 4837318e68e7cc4a09f455313430a945e9242b44e846cf1560d7925368fdaebf
thunderbird-1.5.0.8-0.1.el4.ia64.rpm	SHA-256: 4837318e68e7cc4a09f455313430a945e9242b44e846cf1560d7925368fdaebf
i386
thunderbird-1.5.0.8-0.1.el4.i386.rpm	SHA-256: 00a37ef64e77e52e1a008fff78434236332bf84a869c1fef4f3d0735d10b0987
thunderbird-1.5.0.8-0.1.el4.i386.rpm	SHA-256: 00a37ef64e77e52e1a008fff78434236332bf84a869c1fef4f3d0735d10b0987

Red Hat Enterprise Linux Workstation 4

SRPM
thunderbird-1.5.0.8-0.1.el4.src.rpm	SHA-256: caba3b5d5f25a1ed341fb3424a6904dfb02f38f4e30eca2b522bc10a4f5d51c4
x86_64
thunderbird-1.5.0.8-0.1.el4.x86_64.rpm	SHA-256: 779d74d74deeaf77769e793d36e0654af5165939b896bae83daad4e93786fb3b
ia64
thunderbird-1.5.0.8-0.1.el4.ia64.rpm	SHA-256: 4837318e68e7cc4a09f455313430a945e9242b44e846cf1560d7925368fdaebf
i386
thunderbird-1.5.0.8-0.1.el4.i386.rpm	SHA-256: 00a37ef64e77e52e1a008fff78434236332bf84a869c1fef4f3d0735d10b0987

Red Hat Enterprise Linux Desktop 4

SRPM
thunderbird-1.5.0.8-0.1.el4.src.rpm	SHA-256: caba3b5d5f25a1ed341fb3424a6904dfb02f38f4e30eca2b522bc10a4f5d51c4
x86_64
thunderbird-1.5.0.8-0.1.el4.x86_64.rpm	SHA-256: 779d74d74deeaf77769e793d36e0654af5165939b896bae83daad4e93786fb3b
i386
thunderbird-1.5.0.8-0.1.el4.i386.rpm	SHA-256: 00a37ef64e77e52e1a008fff78434236332bf84a869c1fef4f3d0735d10b0987

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
thunderbird-1.5.0.8-0.1.el4.src.rpm	SHA-256: caba3b5d5f25a1ed341fb3424a6904dfb02f38f4e30eca2b522bc10a4f5d51c4
s390x
thunderbird-1.5.0.8-0.1.el4.s390x.rpm	SHA-256: 3e4303dcdda5dae33f73eebc3ee5767846a7a2a6dbfd66b93ead7e32e7cface7
s390
thunderbird-1.5.0.8-0.1.el4.s390.rpm	SHA-256: 04f0c248eb6f8ce27c94eaab83124bcb2a5901ce6638c9cf5c03e43fe965df7c

Red Hat Enterprise Linux for Power, big endian 4

SRPM
thunderbird-1.5.0.8-0.1.el4.src.rpm	SHA-256: caba3b5d5f25a1ed341fb3424a6904dfb02f38f4e30eca2b522bc10a4f5d51c4
ppc
thunderbird-1.5.0.8-0.1.el4.ppc.rpm	SHA-256: 999220633f08553ad679766c247fe60223be6647e15f98c074680e7490b02fa0