1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 2273-1] icedove security update

    From Moritz Muehlenhoff@1:229/2 to All on Wed Jul 6 20:50:02 2011
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-2273-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff
    July 06, 2011 http://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : icedove
    Vulnerability : several
    Problem type : remote
    Debian-specific: no
    CVE ID : CVE-2011-0083 CVE-2011-0085 CVE-2011-2362 CVE-2011-2363
    CVE-2011-2365 CVE-2011-2371 CVE-2011-2373 CVE-2011-2374
    CVE-2011-2376

    Several vulnerabilities have been discovered in Icedove, an unbranded
    version of the Thunderbird mail/news client.

    CVE-2011-0083 / CVE-2011-2363

    "regenrecht" discovered two use-after-frees in SVG processing,
    which could lead to the execution of arbitrary code.

    CVE-2011-0085

    "regenrecht" discovered a use-after-free in XUL processing, which
    could lead to the execution of arbitrary code.

    CVE-2011-2362

    David Chan discovered that cookies were insufficiently isolated.

    CVE-2011-2371

    Chris Rohlf and Yan Ivnitskiy discovered an integer overflow in the
    Javascript engine, which could lead to the execution of arbitrary
    code.

    CVE-2011-2373

    Martin Barbella discovered a use-after-free in XUL processing,
    which could lead to the execution of arbitrary code.

    CVE-2011-2374

    Bob Clary, Kevin Brosnan, Nils, Gary Kwong, Jesse Ruderman and
    Christian Biesinger discovered memory corruption bugs, which may
    lead to the execution of arbitrary code.

    CVE-2011-2376

    Luke Wagner and Gary Kwong discovered memory corruption bugs, which
    may lead to the execution of arbitrary code.

    As indicated in the Lenny (oldstable) release notes, security support for
    the Icedove packages in the oldstable needed to be stopped before the end
    of the regular Lenny security maintenance life cycle.
    You are strongly encouraged to upgrade to stable or switch to a different
    mail client.

    For the stable distribution (squeeze), this problem has been fixed in
    version 3.0.11-1+squeeze3.

    For the unstable distribution (sid), this problem has been fixed in
    version 3.1.11-1.

    We recommend that you upgrade your icedove packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: http://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.11 (GNU/Linux)

    iEYEARECAAYFAk4UqlsACgkQXm3vHE4uylq9qwCfUfETLCHVqrtFmgCbghNPN3BV 77wAnixFSCQKnQ4ltDwqJWWhrBYYoddU
    =fgNJ
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected] Archive: http://lists.debian.org/[email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)