Red Hat Product Errata RHSA-2010:0780 - Security Advisory

Issued:: 2010-10-19
Updated:: 2010-10-19

RHSA-2010:0780 - Security Advisory

Overview
Updated Packages

Synopsis

Moderate: thunderbird security update

Type/Severity

Security Advisory: Moderate

Topic

An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the processing of malformed HTML mail content.
An HTML mail message containing malicious content could cause Thunderbird
to crash or, potentially, execute arbitrary code with the privileges of the
user running Thunderbird. (CVE-2010-3176, CVE-2010-3180)

Note: JavaScript support is disabled by default in Thunderbird. The above
issues are not exploitable unless JavaScript is enabled.

A flaw was found in the script that launches Thunderbird. The
LD_LIBRARY_PATH variable was appending a "." character, which could allow a
local attacker to execute arbitrary code with the privileges of a different
user running Thunderbird, if that user ran Thunderbird from within an
attacker-controlled directory. (CVE-2010-3182)

All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

Red Hat Enterprise Linux Server 5 x86_64
Red Hat Enterprise Linux Server 5 i386
Red Hat Enterprise Linux Server 4 x86_64
Red Hat Enterprise Linux Server 4 ia64
Red Hat Enterprise Linux Server 4 i386
Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
Red Hat Enterprise Linux Workstation 5 x86_64
Red Hat Enterprise Linux Workstation 5 i386
Red Hat Enterprise Linux Workstation 4 x86_64
Red Hat Enterprise Linux Workstation 4 ia64
Red Hat Enterprise Linux Workstation 4 i386
Red Hat Enterprise Linux Desktop 5 x86_64
Red Hat Enterprise Linux Desktop 5 i386
Red Hat Enterprise Linux Desktop 4 x86_64
Red Hat Enterprise Linux Desktop 4 i386
Red Hat Enterprise Linux for IBM z Systems 4 s390x
Red Hat Enterprise Linux for IBM z Systems 4 s390
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
Red Hat Enterprise Linux for Power, big endian 4 ppc
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
Red Hat Enterprise Linux Server from RHUI 5 x86_64
Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

BZ - 642272 - CVE-2010-3176 Mozilla miscellaneous memory safety hazards
BZ - 642283 - CVE-2010-3180 Mozilla use-after-free error in nsBarProp
BZ - 642300 - CVE-2010-3182 Mozilla unsafe library loading flaw

CVEs

References

http://www.redhat.com/security/updates/classification/#moderate

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 5

SRPM
thunderbird-2.0.0.24-9.el5.src.rpm	SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
x86_64
thunderbird-2.0.0.24-9.el5.x86_64.rpm	SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
i386
thunderbird-2.0.0.24-9.el5.i386.rpm	SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f

Red Hat Enterprise Linux Server 4

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
x86_64
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
ia64
thunderbird-1.5.0.12-31.el4.ia64.rpm	SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
thunderbird-1.5.0.12-31.el4.ia64.rpm	SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
i386
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1

Red Hat Enterprise Linux Server - Extended Update Support 4.8

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
x86_64
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
ia64
thunderbird-1.5.0.12-31.el4.ia64.rpm	SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
thunderbird-1.5.0.12-31.el4.ia64.rpm	SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
i386
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1

Red Hat Enterprise Linux Workstation 5

SRPM
thunderbird-2.0.0.24-9.el5.src.rpm	SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
x86_64
thunderbird-2.0.0.24-9.el5.x86_64.rpm	SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
i386
thunderbird-2.0.0.24-9.el5.i386.rpm	SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f

Red Hat Enterprise Linux Workstation 4

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
x86_64
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
ia64
thunderbird-1.5.0.12-31.el4.ia64.rpm	SHA-256: 7f9b08111d3b4939b3ac6354c9bd775975a5423dada074112d12a68cab35bde9
i386
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1

Red Hat Enterprise Linux Desktop 5

SRPM
thunderbird-2.0.0.24-9.el5.src.rpm	SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
x86_64
thunderbird-2.0.0.24-9.el5.x86_64.rpm	SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
i386
thunderbird-2.0.0.24-9.el5.i386.rpm	SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f

Red Hat Enterprise Linux Desktop 4

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
x86_64
thunderbird-1.5.0.12-31.el4.x86_64.rpm	SHA-256: 4b1acfd0b255493217999012cfddc0007180a58f8ca1ba479f234206bec5d264
i386
thunderbird-1.5.0.12-31.el4.i386.rpm	SHA-256: 0c0500da2b5f66e3569726e5e0dfefc4377c9796564140697ea2cce8072e65b1

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
s390x
thunderbird-1.5.0.12-31.el4.s390x.rpm	SHA-256: 05c6a981bdeed8fa4af1d0c9cbc4a8ad584c5e082868a5c23f4fed90ea8cd7c8
s390
thunderbird-1.5.0.12-31.el4.s390.rpm	SHA-256: cf0b15d1a4b271fd2f784ad5667f991581f84d24d73b1aad3a44ffd7f5874e65

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
s390x
thunderbird-1.5.0.12-31.el4.s390x.rpm	SHA-256: 05c6a981bdeed8fa4af1d0c9cbc4a8ad584c5e082868a5c23f4fed90ea8cd7c8
s390
thunderbird-1.5.0.12-31.el4.s390.rpm	SHA-256: cf0b15d1a4b271fd2f784ad5667f991581f84d24d73b1aad3a44ffd7f5874e65

Red Hat Enterprise Linux for Power, big endian 4

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
ppc
thunderbird-1.5.0.12-31.el4.ppc.rpm	SHA-256: 1c988189f42fc17fe4f0543df69eafca99026d12c9e65de15a059dee7e0f2d50

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8

SRPM
thunderbird-1.5.0.12-31.el4.src.rpm	SHA-256: 9b9c8f5a3f3d0cf18256e33c66121173d8d7e6510a33abe7946a555a2dfb36d1
ppc
thunderbird-1.5.0.12-31.el4.ppc.rpm	SHA-256: 1c988189f42fc17fe4f0543df69eafca99026d12c9e65de15a059dee7e0f2d50

Red Hat Enterprise Linux Server from RHUI 5

SRPM
thunderbird-2.0.0.24-9.el5.src.rpm	SHA-256: bf728139c52b02ac10c7d3a59a9ef6cb9babd9a266f6647f246911014f4d1f52
x86_64
thunderbird-2.0.0.24-9.el5.x86_64.rpm	SHA-256: 8c6c99b5d6e9c8063378d47e98b8b7680b8686fd99d27d219c57c123a6752d78
i386
thunderbird-2.0.0.24-9.el5.i386.rpm	SHA-256: 72f900c3dce6e8659e4ee26777eccc93b2a46bed6ef5628ac0090a73e58f971f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Log in to Your Red Hat Account

Red Hat Account

Customer Portal

Select Your Language

Infrastructure and Management

Cloud Computing

Storage

JBoss Development and Management

JBoss Integration and Automation

Mobile

Services

Tools

Red Hat Product Security Center

Security Updates

Resources

Customer Portal Community

Customer Events

Stories