Synopsis

Critical: thunderbird security update

Type/Severity

Security Advisory: Critical

Topic

An updated thunderbird package that fixes one security issue is now
available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Mozilla Thunderbird is a standalone mail and newsgroup client.

A heap-based buffer overflow flaw was found in the way Thunderbird handled
PNG (Portable Network Graphics) images. An HTML mail message or remote
content containing a specially-crafted PNG image could cause Thunderbird to
crash or, possibly, execute arbitrary code with the privileges of the user
running Thunderbird. (CVE-2011-3026)

All Thunderbird users should upgrade to this updated package, which
corrects this issue. After installing the update, Thunderbird must be
restarted for the changes to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support 6.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 6.2 i386
• Red Hat Enterprise Linux Server - AUS 6.2 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.2 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.2 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386

Fixes

• BZ - 790737 - CVE-2011-3026 libpng: Heap-buffer-overflow in png_decompress_chunk

CVEs

• CVE-2011-3026

References

• https://access.redhat.com/security/updates/classification/#critical

Red Hat Enterprise Linux Server 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e
i386
thunderbird-3.1.18-2.el6_2.i686.rpm	SHA-256: b8c1b1835bcb007b4b38e2a4dbbcdc3a241a5b6574ff9a4b1e769e223e1ee9bc
thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm	SHA-256: c4bcbf020bdb0a0ceaf1a85c9014dd09752aeb63daeac44e7fb4bf72792063d0

Red Hat Enterprise Linux Server - Extended Update Support 6.2

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e
i386
thunderbird-3.1.18-2.el6_2.i686.rpm	SHA-256: b8c1b1835bcb007b4b38e2a4dbbcdc3a241a5b6574ff9a4b1e769e223e1ee9bc
thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm	SHA-256: c4bcbf020bdb0a0ceaf1a85c9014dd09752aeb63daeac44e7fb4bf72792063d0

Red Hat Enterprise Linux Server - AUS 6.2

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e

Red Hat Enterprise Linux Workstation 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e
i386
thunderbird-3.1.18-2.el6_2.i686.rpm	SHA-256: b8c1b1835bcb007b4b38e2a4dbbcdc3a241a5b6574ff9a4b1e769e223e1ee9bc
thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm	SHA-256: c4bcbf020bdb0a0ceaf1a85c9014dd09752aeb63daeac44e7fb4bf72792063d0

Red Hat Enterprise Linux Desktop 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e
i386
thunderbird-3.1.18-2.el6_2.i686.rpm	SHA-256: b8c1b1835bcb007b4b38e2a4dbbcdc3a241a5b6574ff9a4b1e769e223e1ee9bc
thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm	SHA-256: c4bcbf020bdb0a0ceaf1a85c9014dd09752aeb63daeac44e7fb4bf72792063d0

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
s390x
thunderbird-3.1.18-2.el6_2.s390x.rpm	SHA-256: bbcc4d5bda7254b52615327680252e642b9cf3e5cfb45013a6ecc886f82bebdf
thunderbird-debuginfo-3.1.18-2.el6_2.s390x.rpm	SHA-256: 68badad6d5b8d15552232650d537a8aec86de533ee1dd70c16f6ca1991216c80

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.2

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
s390x
thunderbird-3.1.18-2.el6_2.s390x.rpm	SHA-256: bbcc4d5bda7254b52615327680252e642b9cf3e5cfb45013a6ecc886f82bebdf
thunderbird-debuginfo-3.1.18-2.el6_2.s390x.rpm	SHA-256: 68badad6d5b8d15552232650d537a8aec86de533ee1dd70c16f6ca1991216c80

Red Hat Enterprise Linux for Power, big endian 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
ppc64
thunderbird-3.1.18-2.el6_2.ppc64.rpm	SHA-256: 97ff7db20d13e1def9d1bb06e4973d30a1cf11b888bf142abbf8cb3332921e88
thunderbird-debuginfo-3.1.18-2.el6_2.ppc64.rpm	SHA-256: cec28fefdb43483b58da2378500175f3b72529436c25bfaf2652df728567b04b

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.2

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
ppc64
thunderbird-3.1.18-2.el6_2.ppc64.rpm	SHA-256: 97ff7db20d13e1def9d1bb06e4973d30a1cf11b888bf142abbf8cb3332921e88
thunderbird-debuginfo-3.1.18-2.el6_2.ppc64.rpm	SHA-256: cec28fefdb43483b58da2378500175f3b72529436c25bfaf2652df728567b04b

Red Hat Enterprise Linux Server from RHUI 6

SRPM
thunderbird-3.1.18-2.el6_2.src.rpm	SHA-256: 2e27cccb8018a7dfd4adf163ccc92af6a36489d65a39049b054b1c0e70dfb6ea
x86_64
thunderbird-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 8a53a9cf2292c3a2663a288f5b3735d073d7d90373f17a2bdc0fa13c28a0273c
thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm	SHA-256: 386e8a7de7b2a12827079f25fba4b32bb70d5022168ad0c828c6aaba9156db2e
i386
thunderbird-3.1.18-2.el6_2.i686.rpm	SHA-256: b8c1b1835bcb007b4b38e2a4dbbcdc3a241a5b6574ff9a4b1e769e223e1ee9bc
thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm	SHA-256: c4bcbf020bdb0a0ceaf1a85c9014dd09752aeb63daeac44e7fb4bf72792063d0