Bugtraq: [ MDKSA-2006:076 ] - Updated mozilla packages fix numerous vulnerabilities

From: <security_at_mandriva.com>
Date: Tue, 25 Apr 2006 16:21:53 -0600

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:076
http://www.mandriva.com/security/
_______________________________________________________________________

Package : mozilla
Date : April 25, 2006
Affected: Corporate 3.0
_______________________________________________________________________

Problem Description:

A number of vulnerabilities have been discovered in the Mozilla Suite
that could allow a remote attacker to craft malicious web pages that
could take advantage of these issues to execute arbitrary code with
elevated privileges, spoof content, and steal local files, cookies, or
other information from web pages. As well, some of these
vulnerabilities can be exploited to execute arbitrary code with the
privileges of the user running the browser.

As well, two crasher bugs have been fixed as well.

The updated packages have been patched to fix these problems.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790
https://bugzilla.mozilla.org/show_bug.cgi?id=275896
https://bugzilla.mozilla.org/show_bug.cgi?id=330900
_______________________________________________________________________

Updated Packages:

Corporate 3.0:
81dce00119439ab171593eb2976fe547 corporate/3.0/RPMS/libnspr4-1.7.8-0.8.C30mdk.i586.rpm
c0e04b64accc75483ca0795af33562be corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.8.C30mdk.i586.rpm
288e4e8379aa0d7cc56327ba60035e0a corporate/3.0/RPMS/libnss3-1.7.8-0.8.C30mdk.i586.rpm
c1bac96a978df5d75cfd7887a09144d5 corporate/3.0/RPMS/libnss3-devel-1.7.8-0.8.C30mdk.i586.rpm
0d06c6a4520068a368cf48e3f407c74e corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.i586.rpm
73f9e85c4556834db6ef9333b98beef0 corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.i586.rpm
6939f71693b40125b5c3dd0534441d4a corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.i586.rpm
cb3df735d1ce023dd9cfeed26889c91b corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.i586.rpm
7aee6465cb0a42c6561b3c3deac96c8d corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.i586.rpm
01ec6255f2071d246ef76a11b2844c8e corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.i586.rpm
8d4075f4c1c9cd4f613a68ff15f09d85 corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.i586.rpm
cc4bcc8c9c19557513ef30d96150b9fe corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.i586.rpm
05ab0503358b30c10dba88bb916473be corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.i586.rpm
ddccba24ecfaa9f82167a7bb5c9c71ad corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm

Corporate 3.0/X86_64:
9a8e62df1100fa84600706050870a63e x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.8.C30mdk.x86_64.rpm
17c9c8233a462fc91061554c0a0ef451 x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.8.C30mdk.x86_64.rpm
efa25dec22975bab70c748d07e0a3c75 x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.8.C30mdk.x86_64.rpm
38de0287eaf7ed9f2e319cbcc042dcdf x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.8.C30mdk.x86_64.rpm
18393cfe8c07b958e52a6f0f2b506e53 x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.x86_64.rpm
e6aea2fc34c466383781cb6487964cc0 x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.x86_64.rpm
be9a4c7519f064b07b48ea9556866f74 x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.x86_64.rpm
085cc65fea8f657875c5024c0d964a5d x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.x86_64.rpm
1b6244b6bf96093518937ccf8dcd33c6 x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.x86_64.rpm
e66333a5573e85f32effe85a01a64a27 x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.x86_64.rpm
4bfb009ca3dcdc90ff1eb2f244cafdc4 x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.x86_64.rpm
caddf105e2756d3bebf74ad2f4e8a0d6 x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.x86_64.rpm
f1551cc11e1e75be6d25cf2f53070ac0 x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.x86_64.rpm
ddccba24ecfaa9f82167a7bb5c9c71ad x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFETnBTmqjQ0CJFipgRArcTAKDcxTz/GNX8kqak3RR/7w24zwM07gCgiFlz
qBCSTPZ9EPi5eHFsxhS4f2A=
=n4oP
-----END PGP SIGNATURE-----
Received on Apr 26 2006