bugtraq August 2007 archive
Main Archive Page > Month Archives  > bugtraq archives
bugtraq: rPSA-2007-0157-1 firefox thunderbird

rPSA-2007-0157-1 firefox thunderbird

From: rPath Update Announcements <announce-noreply_at_nospam>
Date: Fri Aug 10 2007 - 13:41:33 GMT
To: security-announce@lists.rpath.com, update-announce@lists.rpath.com


rPath Security Advisory: 2007-0157-1
Published: 2007-08-10
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:

    Indirect User Non-deterministic Unauthorized Access Updated Versions:

    firefox=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1     thunderbird=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845 https://issues.rpath.com/browse/RPL-1600

Description:

    Previous versions of the firefox and thunderbird packages are     vulnerable to multiple attacks. One is a weakness that makes it hard     for add-ons to defend against a user-assisted privilege escalation     attack; the other can in some cases allow a user-assisted attacker     to run possibly arbitrary programs as the user running firefox     or thunderbird.     

    As the 1.5.0.x versions of firefox and thunderbird are no longer     being maintained, the new versions of the firefox and thunderbird     packages are new major versions. Of particular note, some firefox     add-ons that are no longer maintained may no longer function with     the new version of firefox.

Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License. A copy is available at http://www.rpath.com/permanent/mit-license.html