Scientific Linux alert SL-thun-20120216 (thunderbird)

From:
    	     
 
riehecky@fnal.gov 
To:
    	     
 
scientific-linux-errata@fnal.gov 
Subject:
    	     
 
Security ERRATA Critical: thunderbird on SL6.x i386/x86_64 
Date:
    	     
 
Thu, 16 Feb 2012 16:41:44 -0600
Message-ID:
    	     
 
<201202162241.q1GMfiT8021724@fefmon2.fnal.gov>

Synopsis:    Critical: thunderbird security update
Issue Date:  2012-02-16
CVE Numbers: CVE-2011-3026


Mozilla Thunderbird is a standalone mail and newsgroup client.

A heap-based buffer overflow flaw was found in the way Thunderbird handled
PNG (Portable Network Graphics) images. An HTML mail message or remote
content containing a specially-crafted PNG image could cause Thunderbird to
crash or, possibly, execute arbitrary code with the privileges of the user
running Thunderbird. (CVE-2011-3026)

All Thunderbird users should upgrade to this updated package, which
corrects this issue. After installing the update, Thunderbird must be
restarted for the changes to take effect.

SL6:
  i386
     thunderbird-3.1.18-2.el6_2.i686.rpm
     thunderbird-debuginfo-3.1.18-2.el6_2.i686.rpm
  x86_64
     thunderbird-3.1.18-2.el6_2.x86_64.rpm
     thunderbird-debuginfo-3.1.18-2.el6_2.x86_64.rpm

- Scientific Linux Development Team