[SECURITY] [DSA 2187-1] icedove security update

ID DEBIAN:DSA-2187-1:21087
Type debian
Reporter Debian
Modified 2011-03-10T09:35:48


Debian Security Advisory DSA-2187-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff March 09, 2011 http://www.debian.org/security/faq

Package : icedove Vulnerability : several Problem type : remote Debian-specific: no CVE ID : CVE-2010-1585 CVE-2011-0051 CVE-2011-0053 CVE-2011-0054 CVE-2011-0055 CVE-2011-0056 CVE-2011-0057 CVE-2011-0059

Several vulnerabilities have been discovered in Icedove, an unbranded version of the Thunderbird mail/news client.


Roberto Suggi Liverani discovered that the sanitising performed by ParanoidFragmentSink was incomplete.


Crashes in the layout engine may lead to the execution of arbitrary code.


Zach Hoffmann discovered that incorrect parsing of recursive eval() calls could lead to attackers forcing acceptance of a confirmation dialogue.

CVE-2011-0054, CVE-2010-0056

Christian Holler discovered buffer overflows in the Javascript engine, which could allow the execution of arbitrary code.


"regenrecht" and Igor Bukanov discovered a use-after-free error in the JSON-Implementation, which could lead to the execution of arbitrary code.


Daniel Kozlowski discovered that incorrect memory handling the web workers implementation could lead to the execution of arbitrary code.


Peleus Uhley discovered a cross-site request forgery risk in the plugin code.

As indicated in the Lenny (oldstable) release notes, security support for the Icedove packages in the oldstable needed to be stopped before the end of the regular Lenny security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a different mail client.

For the stable distribution (squeeze), this problem has been fixed in version 3.0.11-1+squeeze1.

For the unstable distribution (sid), this problem has been fixed in version 3.0.11-2.

We recommend that you upgrade your icedove packages.

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org