Sinopsis

Critical: seamonkey security update

Tipo/Gravedad

Security Advisory: Critical

Tema:

Updated seamonkey packages that fix several security issues are now
available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Descripción

SeaMonkey is an open source Web browser, email and newsgroup client, IRC
chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-1303, CVE-2009-1305)

Several flaws were found in the way malformed web content was processed. A
web page containing malicious content could execute arbitrary JavaScript in
the context of the site, possibly presenting misleading data to a user, or
stealing sensitive information such as login credentials. (CVE-2009-0652,
CVE-2009-1306, CVE-2009-1307, CVE-2009-1309, CVE-2009-1312)

A flaw was found in the way SeaMonkey saved certain web pages to a local
file. If a user saved the inner frame of a web page containing POST data,
the POST data could be revealed to the inner frame, possibly surrendering
sensitive information such as login credentials. (CVE-2009-1311)

All SeaMonkey users should upgrade to these updated packages, which correct
these issues. After installing the update, SeaMonkey must be restarted for
the changes to take effect.

Solución

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Productos afectados

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc

Correcciones

• BZ - 486704 - CVE-2009-0652 firefox: does not properly prevent the literal rendering of homoglyph characters in IDN domain names (spoof URLs and conduct phishing attacks)
• BZ - 496253 - CVE-2009-1303 Firefox 2 and 3 Layout engine crash
• BZ - 496256 - CVE-2009-1305 Firefox 2 and 3 JavaScript engine crash
• BZ - 496262 - CVE-2009-1306 Firefox jar: scheme ignores the content-disposition: header on the inner URI
• BZ - 496263 - CVE-2009-1307 Firefox Same-origin violations when Adobe Flash loaded via view-source: protocol
• BZ - 496267 - CVE-2009-1309 Firefox Same-origin violations in XMLHttpRequest and XPCNativeWrapper.toString
• BZ - 496271 - CVE-2009-1311 Firefox POST data sent to wrong site when saving web page with embedded frame
• BZ - 496274 - CVE-2009-1312 Firefox allows Refresh header to redirect to javascript: URIs

CVE

• CVE-2009-1311
• CVE-2009-1303
• CVE-2009-1312
• CVE-2009-1306
• CVE-2009-1307
• CVE-2009-1305
• CVE-2009-1309
• CVE-2009-0652

Referencias

• http://www.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390
seamonkey-1.0.9-41.el4.s390.rpm	SHA-256: 85edd1d991d313c4ca65f663a2183ddfa7f6f4b22726f5ea52e0f6b57034c18c
seamonkey-chat-1.0.9-41.el4.s390.rpm	SHA-256: 40114e1ba87e44e87eda8e137a7eb44ec24e1c1813ed72c9aecf31930f10fa8a
seamonkey-devel-1.0.9-41.el4.s390.rpm	SHA-256: 06a6696d4b4c7517811bfb8b1a061f4ac8cebb07dddafc5cabc622884d08b6af
seamonkey-dom-inspector-1.0.9-41.el4.s390.rpm	SHA-256: e426393322a4636548fcc72a9d4a044581d02d3088c1210e3276c25a9d17d105
seamonkey-js-debugger-1.0.9-41.el4.s390.rpm	SHA-256: edaa38c25d0cc10510577ec42ef2d36a6c636d6763be2927e87ffa23b30bc5ed
seamonkey-mail-1.0.9-41.el4.s390.rpm	SHA-256: 6a3fd842987ef336c1a5c2ab648bde3742c74d610b3edff8846dc5dabf7be609

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7

SRPM
s390
seamonkey-1.0.9-41.el4.s390.rpm	SHA-256: 85edd1d991d313c4ca65f663a2183ddfa7f6f4b22726f5ea52e0f6b57034c18c
seamonkey-chat-1.0.9-41.el4.s390.rpm	SHA-256: 40114e1ba87e44e87eda8e137a7eb44ec24e1c1813ed72c9aecf31930f10fa8a
seamonkey-devel-1.0.9-41.el4.s390.rpm	SHA-256: 06a6696d4b4c7517811bfb8b1a061f4ac8cebb07dddafc5cabc622884d08b6af
seamonkey-dom-inspector-1.0.9-41.el4.s390.rpm	SHA-256: e426393322a4636548fcc72a9d4a044581d02d3088c1210e3276c25a9d17d105
seamonkey-js-debugger-1.0.9-41.el4.s390.rpm	SHA-256: edaa38c25d0cc10510577ec42ef2d36a6c636d6763be2927e87ffa23b30bc5ed
seamonkey-mail-1.0.9-41.el4.s390.rpm	SHA-256: 6a3fd842987ef336c1a5c2ab648bde3742c74d610b3edff8846dc5dabf7be609