Skip to navigation

Security Advisory Moderate: thunderbird security update

Advisory: RHSA-2007:0981-2
Type: Security Advisory
Severity: Moderate
Issued on: 2007-10-19
Last updated on: 2007-10-19
Affected Products: RHEL Optional Productivity Applications (v. 5 server)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.5.z)
Red Hat Enterprise Linux Desktop (v. 5 client)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.5.z)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2007-1095
CVE-2007-2292
CVE-2007-3511
CVE-2007-3844
CVE-2007-5334
CVE-2007-5337
CVE-2007-5338
CVE-2007-5339
CVE-2007-5340

Details

Updated thunderbird packages that fix several security bugs are now
available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Mozilla Thunderbird is a standalone mail and newsgroup client.

Several flaws were found in the way in which Thunderbird processed certain
malformed HTML mail content. An HTML mail message containing malicious
content could cause Thunderbird to crash or potentially execute arbitrary
code as the user running Thunderbird. JavaScript support is disabled by
default in Thunderbird; these issues are not exploitable unless the user
has enabled JavaScript. (CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)

Several flaws were found in the way in which Thunderbird displayed
malformed HTML mail content. An HTML mail message containing
specially-crafted content could potentially trick a user into surrendering
sensitive information. (CVE-2007-1095, CVE-2007-3844, CVE-2007-3511,
CVE-2007-5334)

A flaw was found in the Thunderbird sftp protocol handler. A malicious HTML
mail message could access data from a remote sftp site, possibly stealing
sensitive user data. (CVE-2007-5337)

A request-splitting flaw was found in the way in which Thunderbird
generates a digest authentication request. If a user opened a
specially-crafted URL, it was possible to perform cross-site scripting
attacks, web cache poisoning, or other, similar exploits. (CVE-2007-2292)

Users of Thunderbird are advised to upgrade to these erratum packages,
which contain backported patches that correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

RHEL Optional Productivity Applications (v. 5 server)

SRPMS:
thunderbird-1.5.0.12-5.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: dda97b140a9002f46639c7836d110065
 
IA-32:
thunderbird-1.5.0.12-5.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 379a1f33e2cd351ff772852ecc30b290
 
x86_64:
thunderbird-1.5.0.12-5.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e948a39bad632b09c0bee08ef65f16b6
 
Red Hat Desktop (v. 4)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 85ce35b976888a1591d3c58de77af18a
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 275fc6584beeff8258a2e4b85d11de41
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 85ce35b976888a1591d3c58de77af18a
 
IA-64:
thunderbird-1.5.0.12-0.5.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: b1de1c0e22e09d3d58edf1dd7631ee67
 
PPC:
thunderbird-1.5.0.12-0.5.el4.ppc.rpm
File outdated by:  RHSA-2012:0085
    MD5: 2ac3cf8c6ce9be5b6a63632cbb801a1f
 
s390:
thunderbird-1.5.0.12-0.5.el4.s390.rpm
File outdated by:  RHSA-2012:0085
    MD5: 9924d1f9427276da09607fae32941262
 
s390x:
thunderbird-1.5.0.12-0.5.el4.s390x.rpm
File outdated by:  RHSA-2012:0085
    MD5: 7b2dbfdbcc08d51f4611e3dc18e3d969
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 275fc6584beeff8258a2e4b85d11de41
 
Red Hat Enterprise Linux AS (v. 4.5.z)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm     MD5: 85ce35b976888a1591d3c58de77af18a
 
IA-64:
thunderbird-1.5.0.12-0.5.el4.ia64.rpm     MD5: b1de1c0e22e09d3d58edf1dd7631ee67
 
PPC:
thunderbird-1.5.0.12-0.5.el4.ppc.rpm     MD5: 2ac3cf8c6ce9be5b6a63632cbb801a1f
 
s390:
thunderbird-1.5.0.12-0.5.el4.s390.rpm     MD5: 9924d1f9427276da09607fae32941262
 
s390x:
thunderbird-1.5.0.12-0.5.el4.s390x.rpm     MD5: 7b2dbfdbcc08d51f4611e3dc18e3d969
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm     MD5: 275fc6584beeff8258a2e4b85d11de41
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
thunderbird-1.5.0.12-5.el5.src.rpm
File outdated by:  RHSA-2014:0316
    MD5: dda97b140a9002f46639c7836d110065
 
IA-32:
thunderbird-1.5.0.12-5.el5.i386.rpm
File outdated by:  RHSA-2014:0316
    MD5: 379a1f33e2cd351ff772852ecc30b290
 
x86_64:
thunderbird-1.5.0.12-5.el5.x86_64.rpm
File outdated by:  RHSA-2014:0316
    MD5: e948a39bad632b09c0bee08ef65f16b6
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 85ce35b976888a1591d3c58de77af18a
 
IA-64:
thunderbird-1.5.0.12-0.5.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: b1de1c0e22e09d3d58edf1dd7631ee67
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 275fc6584beeff8258a2e4b85d11de41
 
Red Hat Enterprise Linux ES (v. 4.5.z)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm     MD5: 85ce35b976888a1591d3c58de77af18a
 
IA-64:
thunderbird-1.5.0.12-0.5.el4.ia64.rpm     MD5: b1de1c0e22e09d3d58edf1dd7631ee67
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm     MD5: 275fc6584beeff8258a2e4b85d11de41
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
thunderbird-1.5.0.12-0.5.el4.src.rpm
File outdated by:  RHSA-2012:0085
    MD5: e6069c001427ad2e2f4c5f5ab0b5f85a
 
IA-32:
thunderbird-1.5.0.12-0.5.el4.i386.rpm
File outdated by:  RHSA-2012:0085
    MD5: 85ce35b976888a1591d3c58de77af18a
 
IA-64:
thunderbird-1.5.0.12-0.5.el4.ia64.rpm
File outdated by:  RHSA-2012:0085
    MD5: b1de1c0e22e09d3d58edf1dd7631ee67
 
x86_64:
thunderbird-1.5.0.12-0.5.el4.x86_64.rpm
File outdated by:  RHSA-2012:0085
    MD5: 275fc6584beeff8258a2e4b85d11de41
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

333991 - Mozilla products security update (CVE-2007-1095, CVE-2007-2292, CVE-2007-3511, CVE-2007-3844, CVE-2007-5334, CVE-2007-5337, CVE-2007-5338, CVE-2007-5339, CVE-2007-5340)


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/