Mageia alert MGASA-2012-0343 (thunderbird)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2012-0343: mozilla-thunderbird-10.0.11-1.mga1 (1/core), thunderbird-10.0.11-1.mga2 (2/core) | |
| Date: | Fri, 23 Nov 2012 23:09:23 +0100 | |
| Message-ID: | <20121123220923.GA20279@valstar.mageia.org> |
MGASA-2012-0343 Date: November 23rd, 2012 Affected releases: 1, 2 Description: Updated mozilla thunderbird packages fix security vulnerabilities: Several flaws were found in the processing of malformed content. Malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-5829, CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5839, CVE-2012-5840, CVE-2012-5842). A buffer overflow flaw was found in the way Thunderbird handled GIF (Graphics Interchange Format) images. Content containing a malicious GIF image could cause Thunderbird to crash or, possibly, execute arbitrary code with the privileges of the user running Thunderbird (CVE-2012-4202). A flaw was found in the way Thunderbird decoded the HZ-GB-2312 character encoding. Malicious content could cause Thunderbird to run JavaScript code with the permissions of different content (CVE-2012-4207). A flaw was found in the location object implementation in Thunderbird. Malicious content could possibly use this flaw to allow restricted content to be loaded by plug-ins (CVE-2012-4209). A flaw was found in the way cross-origin wrappers were implemented. Malicious content could use this flaw to perform cross-site scripting attacks (CVE-2012-5841). A flaw was found in the evalInSandbox implementation in Thunderbird. Malicious content could use this flaw to perform cross-site scripting attacks (CVE-2012-4201). Updated Packages: Mageia 1: mozilla-thunderbird-10.0.11-1.mga1 mozilla-thunderbird-enigmail-10.0.11-1.mga1 mozilla-thunderbird-ar-10.0.11-1.mga1 mozilla-thunderbird-ast-10.0.11-1.mga1 mozilla-thunderbird-be-10.0.11-1.mga1 mozilla-thunderbird-bg-10.0.11-1.mga1 mozilla-thunderbird-bn_BD-10.0.11-1.mga1 mozilla-thunderbird-br-10.0.11-1.mga1 mozilla-thunderbird-ca-10.0.11-1.mga1 mozilla-thunderbird-cs-10.0.11-1.mga1 mozilla-thunderbird-da-10.0.11-1.mga1 mozilla-thunderbird-de-10.0.11-1.mga1 mozilla-thunderbird-el-10.0.11-1.mga1 mozilla-thunderbird-en_GB-10.0.11-1.mga1 mozilla-thunderbird-es_AR-10.0.11-1.mga1 mozilla-thunderbird-es_ES-10.0.11-1.mga1 mozilla-thunderbird-et-10.0.11-1.mga1 mozilla-thunderbird-eu-10.0.11-1.mga1 mozilla-thunderbird-fi-10.0.11-1.mga1 mozilla-thunderbird-fr-10.0.11-1.mga1 mozilla-thunderbird-fy-10.0.11-1.mga1 mozilla-thunderbird-ga-10.0.11-1.mga1 mozilla-thunderbird-gd-10.0.11-1.mga1 mozilla-thunderbird-gl-10.0.11-1.mga1 mozilla-thunderbird-he-10.0.11-1.mga1 mozilla-thunderbird-hu-10.0.11-1.mga1 mozilla-thunderbird-id-10.0.11-1.mga1 mozilla-thunderbird-is-10.0.11-1.mga1 mozilla-thunderbird-it-10.0.11-1.mga1 mozilla-thunderbird-ja-10.0.11-1.mga1 mozilla-thunderbird-ko-10.0.11-1.mga1 mozilla-thunderbird-lt-10.0.11-1.mga1 mozilla-thunderbird-nb_NO-10.0.11-1.mga1 mozilla-thunderbird-nl-10.0.11-1.mga1 mozilla-thunderbird-nn_NO-10.0.11-1.mga1 mozilla-thunderbird-pa_IN-10.0.11-1.mga1 mozilla-thunderbird-pl-10.0.11-1.mga1 mozilla-thunderbird-pt_BR-10.0.11-1.mga1 mozilla-thunderbird-pt_PT-10.0.11-1.mga1 mozilla-thunderbird-ro-10.0.11-1.mga1 mozilla-thunderbird-ru-10.0.11-1.mga1 mozilla-thunderbird-si-10.0.11-1.mga1 mozilla-thunderbird-sk-10.0.11-1.mga1 mozilla-thunderbird-sl-10.0.11-1.mga1 mozilla-thunderbird-sq-10.0.11-1.mga1 mozilla-thunderbird-sv_SE-10.0.11-1.mga1 mozilla-thunderbird-ta_LK-10.0.11-1.mga1 mozilla-thunderbird-tr-10.0.11-1.mga1 mozilla-thunderbird-uk-10.0.11-1.mga1 mozilla-thunderbird-vi-10.0.11-1.mga1 mozilla-thunderbird-zh_CN-10.0.11-1.mga1 mozilla-thunderbird-zh_TW-10.0.11-1.mga1 nsinstall-10.0.11-1.mga1 Mageia 2: nsinstall-10.0.11-1.mga2 thunderbird-10.0.11-1.mga2 thunderbird-enigmail-10.0.11-1.mga2 thunderbird-ar-10.0.11-1.mga2 thunderbird-ast-10.0.11-1.mga2 thunderbird-be-10.0.11-1.mga2 thunderbird-bg-10.0.11-1.mga2 thunderbird-bn_BD-10.0.11-1.mga2 thunderbird-br-10.0.11-1.mga2 thunderbird-ca-10.0.11-1.mga2 thunderbird-cs-10.0.11-1.mga2 thunderbird-da-10.0.11-1.mga2 thunderbird-de-10.0.11-1.mga2 thunderbird-el-10.0.11-1.mga2 thunderbird-en_GB-10.0.11-1.mga2 thunderbird-es_AR-10.0.11-1.mga2 thunderbird-es_ES-10.0.11-1.mga2 thunderbird-et-10.0.11-1.mga2 thunderbird-eu-10.0.11-1.mga2 thunderbird-fi-10.0.11-1.mga2 thunderbird-fr-10.0.11-1.mga2 thunderbird-fy-10.0.11-1.mga2 thunderbird-ga-10.0.11-1.mga2 thunderbird-gd-10.0.11-1.mga2 thunderbird-gl-10.0.11-1.mga2 thunderbird-he-10.0.11-1.mga2 thunderbird-hu-10.0.11-1.mga2 thunderbird-id-10.0.11-1.mga2 thunderbird-is-10.0.11-1.mga2 thunderbird-it-10.0.11-1.mga2 thunderbird-ja-10.0.11-1.mga2 thunderbird-ko-10.0.11-1.mga2 thunderbird-lt-10.0.11-1.mga2 thunderbird-nb_NO-10.0.11-1.mga2 thunderbird-nl-10.0.11-1.mga2 thunderbird-nn_NO-10.0.11-1.mga2 thunderbird-pa_IN-10.0.11-1.mga2 thunderbird-pl-10.0.11-1.mga2 thunderbird-pt_BR-10.0.11-1.mga2 thunderbird-pt_PT-10.0.11-1.mga2 thunderbird-ro-10.0.11-1.mga2 thunderbird-ru-10.0.11-1.mga2 thunderbird-si-10.0.11-1.mga2 thunderbird-sk-10.0.11-1.mga2 thunderbird-sl-10.0.11-1.mga2 thunderbird-sq-10.0.11-1.mga2 thunderbird-sv_SE-10.0.11-1.mga2 thunderbird-ta_LK-10.0.11-1.mga2 thunderbird-tr-10.0.11-1.mga2 thunderbird-uk-10.0.11-1.mga2 thunderbird-vi-10.0.11-1.mga2 thunderbird-zh_CN-10.0.11-1.mga2 thunderbird-zh_TW-10.0.11-1.mga2 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4201 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4202 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4207 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4209 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4215 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4216 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5829 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5830 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5833 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5835 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5839 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5840 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5841 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5842 http://www.mozilla.org/security/announce/2012/mfsa2012-91... http://www.mozilla.org/security/announce/2012/mfsa2012-92... http://www.mozilla.org/security/announce/2012/mfsa2012-93... http://www.mozilla.org/security/announce/2012/mfsa2012-10... http://www.mozilla.org/security/announce/2012/mfsa2012-10... http://www.mozilla.org/security/announce/2012/mfsa2012-10... http://www.mozilla.org/security/announce/2012/mfsa2012-10... http://www.mozilla.org/security/announce/2012/mfsa2012-10... https://rhn.redhat.com/errata/RHSA-2012-1483.html https://bugs.mageia.org/show_bug.cgi?id=8181 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...