Synopsis

Critical: seamonkey security update

Type/Severity

Security Advisory: Critical

Topic

Updated seamonkey packages that fix several security issues are now
available for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

SeaMonkey is an open source Web browser, email and newsgroup client, IRC
chat client, and HTML editor.

Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code as the user running SeaMonkey.
(CVE-2009-1392, CVE-2009-1833, CVE-2009-1838, CVE-2009-1841)

A flaw was found in the processing of malformed, local file content. If a
user loaded malicious, local content via the file:// URL, it was possible
for that content to access other local data. (CVE-2009-1835)

All SeaMonkey users should upgrade to these updated packages, which correct
these issues. After installing the update, SeaMonkey must be restarted for
the changes to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 503568 - CVE-2009-1392 Firefox browser engine crashes
• BZ - 503570 - CVE-2009-1833 Firefox JavaScript engine crashes
• BZ - 503576 - CVE-2009-1835 Firefox Arbitrary domain cookie access by local file: resources
• BZ - 503580 - CVE-2009-1838 Firefox arbitrary code execution flaw
• BZ - 503583 - CVE-2009-1841 Firefox JavaScript arbitrary code execution

CVEs

• CVE-2009-1833
• CVE-2009-1841
• CVE-2009-1838
• CVE-2009-1392
• CVE-2009-1835

References

• http://www.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390
seamonkey-1.0.9-43.el4_8.s390.rpm	SHA-256: 6ea9a837e1e2263dde1238c12c9a7abb8e6fbde5e1fb0b63363442f21b30430f
seamonkey-chat-1.0.9-43.el4_8.s390.rpm	SHA-256: bd2ebf16e48fa46a998b0e1835d69b3af0b7358593eca8d5fe967bc3d77b3401
seamonkey-devel-1.0.9-43.el4_8.s390.rpm	SHA-256: 48e03e05b1238fb95e6f6e29cc9bac88580988f5f142679370936e3ee278aa63
seamonkey-dom-inspector-1.0.9-43.el4_8.s390.rpm	SHA-256: 81184b2da3e36c471bc892a5f3edb081992c0da23a7e43e4b9fa9ded56a272b1
seamonkey-js-debugger-1.0.9-43.el4_8.s390.rpm	SHA-256: cad77eb14aa40d7be031b26a917deec0415c9b52399d359f67bccf24bf9d2875
seamonkey-mail-1.0.9-43.el4_8.s390.rpm	SHA-256: 7d84b5711b392166fd2561445c8521521382e4ea617e8a65dbb82e091ee6473e

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
s390
seamonkey-1.0.9-43.el4_8.s390.rpm	SHA-256: 6ea9a837e1e2263dde1238c12c9a7abb8e6fbde5e1fb0b63363442f21b30430f
seamonkey-chat-1.0.9-43.el4_8.s390.rpm	SHA-256: bd2ebf16e48fa46a998b0e1835d69b3af0b7358593eca8d5fe967bc3d77b3401
seamonkey-devel-1.0.9-43.el4_8.s390.rpm	SHA-256: 48e03e05b1238fb95e6f6e29cc9bac88580988f5f142679370936e3ee278aa63
seamonkey-dom-inspector-1.0.9-43.el4_8.s390.rpm	SHA-256: 81184b2da3e36c471bc892a5f3edb081992c0da23a7e43e4b9fa9ded56a272b1
seamonkey-js-debugger-1.0.9-43.el4_8.s390.rpm	SHA-256: cad77eb14aa40d7be031b26a917deec0415c9b52399d359f67bccf24bf9d2875
seamonkey-mail-1.0.9-43.el4_8.s390.rpm	SHA-256: 7d84b5711b392166fd2561445c8521521382e4ea617e8a65dbb82e091ee6473e