[ GLSA 200608-04 ] Mozilla Thunderbird: Multiple vulnerabilities

[Thierry Carrez <koon () gentoo org>]

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200608-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Mozilla Thunderbird: Multiple vulnerabilities
      Date: August 03, 2006
      Bugs: #141842
        ID: 200608-04

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

The Mozilla Foundation has reported numerous security vulnerabilities
related to Mozilla Thunderbird.

Background
==========

The Mozilla Thunderbird mail client is a redesign of the Mozilla Mail
component. The goal is to produce a cross-platform stand-alone mail
application using XUL (XML User Interface Language).

Affected packages
=================

    -------------------------------------------------------------------
     Package                  /  Vulnerable  /              Unaffected
    -------------------------------------------------------------------
  1  mozilla-thunderbird          < 1.5.0.5                 >= 1.5.0.5
  2  mozilla-thunderbird-bin      < 1.5.0.5                 >= 1.5.0.5
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

The following vulnerabilities have been reported:

* Benjamin Smedberg discovered that chrome URLss could be made to
  reference remote files.

* Developers in the Mozilla community looked for and fixed several
  crash bugs to improve the stability of Mozilla clients.

* "shutdown" reports that cross-site scripting (XSS) attacks could be
  performed using the construct XPCNativeWrapper(window).Function(...),
  which created a function that appeared to belong to the window in
  question even after it had been navigated to the target site.

* "shutdown" reports that scripts granting the UniversalBrowserRead
  privilege can leverage that into the equivalent of the far more
  powerful UniversalXPConnect since they are allowed to "read" into a
  privileged context.

* "moz_bug_r_a4" discovered that Named JavaScript functions have a
  parent object created using the standard Object() constructor
  (ECMA-specified behavior) and that this constructor can be redefined
  by script (also ECMA-specified behavior).

* Igor Bukanov and shutdown found additional places where an untimely
  garbage collection could delete a temporary object that was in active
  use.

* Georgi Guninski found potential integer overflow issues with long
  strings in the toSource() methods of the Object, Array and String
  objects as well as string function arguments.

* H. D. Moore reported a testcase that was able to trigger a race
  condition where JavaScript garbage collection deleted a temporary
  variable still being used in the creation of a new Function object.

* A malicious page can hijack native DOM methods on a document object
  in another domain, which will run the attacker's script when called
  by the victim page.

* Secunia Research has discovered a vulnerability which is caused due
  to an memory corruption error within the handling of simultaneously
  happening XPCOM events. This leads to use of a deleted timer object.

Impact
======

A user can be enticed to open specially crafted URLs, visit webpages
containing malicious JavaScript or execute a specially crafted script.
These events could lead to the execution of arbitrary code, or the
installation of malware on the user's computer.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mozilla Thunderbird users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose
">=mail-client/mozilla-thunderbird-1.5.0.5"

All Mozilla Thunderbird binary users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose
">=mail-client/mozilla-thunderbird-bin-1.5.0.5"

References
==========

  [ 1 ] CVE-2006-3113
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113
  [ 2 ] CVE-2006-3802
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802
  [ 3 ] CVE-2006-3803
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
  [ 4 ] CVE-2006-3804
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804
  [ 5 ] CVE-2006-3805
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805
  [ 6 ] CVE-2006-3806
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806
  [ 7 ] CVE-2006-3807
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807
  [ 8 ] CVE-2006-3809
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809
  [ 9 ] CVE-2006-3810
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810
  [ 10 ] CVE-2006-3811
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811
  [ 11 ] CVE-2006-3812
         http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200608-04.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security () gentoo org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/