RHSA-2008:0908 - Security Advisory

Topic

Updated thunderbird packages that fix several security issues are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed HTML mail content.
An HTML mail message containing malicious content could cause Thunderbird
to crash or, potentially, execute arbitrary code as the user running
Thunderbird. (CVE-2008-0016, CVE-2008-4058, CVE-2008-4059, CVE-2008-4060,
CVE-2008-4061, CVE-2008-4062)

Several flaws were found in the way malformed HTML mail content was
displayed. An HTML mail message containing specially crafted content could
potentially trick a Thunderbird user into surrendering sensitive
information. (CVE-2008-3835, CVE-2008-4067, CVE-2008-4068)

A flaw was found in Thunderbird that caused certain characters to be
stripped from JavaScript code. This flaw could allow malicious JavaScript
to bypass or evade script filters. (CVE-2008-4065, CVE-2008-4066)

Note: JavaScript support is disabled by default in Thunderbird; the above
issue is not exploitable unless JavaScript is enabled.

A heap based buffer overflow flaw was found in the handling of cancelled
newsgroup messages. If the user cancels a specially crafted newsgroup
message it could cause Thunderbird to crash or, potentially, execute
arbitrary code as the user running Thunderbird. (CVE-2008-4070)

All Thunderbird users should upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 463181 - CVE-2008-0016 Mozilla UTF-8 stack buffer overflow
• BZ - 463182 - CVE-2008-3835 mozilla: nsXMLDocument::OnChannelRedirect() same-origin violation
• BZ - 463190 - CVE-2008-4058 Mozilla privilege escalation via XPCnativeWrapper pollution
• BZ - 463192 - CVE-2008-4059 Mozilla privilege escalation via XPCnativeWrapper pollution
• BZ - 463198 - CVE-2008-4060 Mozilla privilege escalation via XPCnativeWrapper pollution
• BZ - 463199 - CVE-2008-4061 Mozilla layout engine crash
• BZ - 463201 - CVE-2008-4062 Mozilla crashes with evidence of memory corruption
• BZ - 463234 - CVE-2008-4065 Mozilla BOM characters stripped from JavaScript before execution
• BZ - 463243 - CVE-2008-4066 Mozilla low surrogates stripped from JavaScript before execution
• BZ - 463246 - CVE-2008-4067 Mozilla resource: traversal vulnerability
• BZ - 463248 - CVE-2008-4068 Mozilla local HTML file recource: bypass
• BZ - 464041 - CVE-2008-4070 Thunderbird cancelled newsgrop messages

CVEs

• CVE-2008-4062
• CVE-2008-4061
• CVE-2008-4060
• CVE-2008-4067
• CVE-2008-4065
• CVE-2008-4068
• CVE-2008-4058
• CVE-2008-0016
• CVE-2008-4066
• CVE-2008-4059
• CVE-2008-3835
• CVE-2008-4070

References

• http://www.redhat.com/security/updates/classification/#moderate