Mozilla Thunderbird < 1.5.0.14 Multiple Vulnerabilities

The remote version of Mozilla Thunderbird suffers from various security issues, several of which may lead to execution of arbitrary code on the affected host subject to the user's privileges. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid29743; scriptversion"1.15";...

Slackware 10.2 / 11.0 / 12.0 / current : mozilla-thunderbird (SSA:2007-324-01)

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix security issues. Slackware is not vulnerable to either of these in its default configuration, but watch out if you've enabled JavaScript. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

GLSA-200711-24 : Mozilla Thunderbird: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200711-24 Mozilla Thunderbird: Multiple vulnerabilities Multiple vulnerabilities have been reported in Mozilla Thunderbird's HTML browser engine CVE-2007-5339 and JavaScript engine CVE-2007-5340 that can be exploited to cause a...

[SECURITY] Fedora 7 Update: thunderbird-2.0.0.9-1.fc7

Mozilla Thunderbird is a standalone mail and newsgroup client...

Mozilla Thunderbird < 2.0.0.9 Multiple Vulnerabilities

The remote version of Mozilla Thunderbird is affected by some memory corruption issues that could result in remote code execution if JavaScript is enabled when viewing specially crafted messages. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid28226;...

Fedora 7 : thunderbird-2.0.0.9-1.fc7 (2007-3431)

Updated thunderbird packages that fix several security bugs are now available for Fedora Core 7. This update has been rated as having moderate security impact by the Fedora Security Response Team. Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way i...

Ubuntu 6.06 LTS / 6.10 / 7.04 : mozilla-thunderbird vulnerabilities (USN-503-1)

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious email, an attacker could execute arbitrary code with the user's privileges. Please note that JavaScript is disabled by default for emails, and it is not recommended to enable it...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-352-1)

Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious email containing JavaScript. Please note that JavaScript is disabled by default for emails, and it is not recommended to enable it. CVE-2006-4253,...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-297-1)

Jonas Sicking discovered that under some circumstances persisted XUL attributes are associated with the wrong URL. A malicious website could exploit this to execute arbitrary code with the privileges of the user. MFSA 2006-35, CVE-2006-2775 Paul Nickerson discovered that content-defined setters o...

Ubuntu 5.10 / 6.06 LTS / 6.10 : mozilla-thunderbird vulnerabilities (USN-431-1)

The SSLv2 protocol support in the NSS library did not sufficiently check the validity of public keys presented with a SSL certificate. A malicious SSL website using SSLv2 could potentially exploit this to execute arbitrary code with the user's privileges. CVE-2007-0008 The SSLv2 protocol support ...

Ubuntu 5.04 / 5.10 : mozilla-thunderbird vulnerabilities (USN-297-3)

USN-297-1 fixed several vulnerabilities in Thunderbird for the Ubuntu 6.06 LTS release. This update provides the corresponding fixes for Ubuntu 5.04 and Ubuntu 5.10. For reference, these are the details of the original USN : Jonas Sicking discovered that under some circumstances persisted XUL...

Ubuntu 6.06 LTS / 6.10 / 7.04 : mozilla-thunderbird vulnerabilities (USN-469-1)

Gaetan Leurent showed a weakness in APOP authentication. An attacker posing as a trusted server could recover portions of the user's password via multiple authentication attempts. CVE-2007-1558 Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a...

Ubuntu 6.06 LTS / 6.10 / 7.04 : enigmail regression (USN-469-2)

USN-469-1 fixed vulnerabilities in the Mozilla Thunderbird email client. The updated Thunderbird version broken compatibility with the Enigmail plugin. This update corrects the problem. We apologize for the inconvenience. Note that Tenable Network Security has extracted the preceding description...

Ubuntu 5.10 : mozilla-thunderbird vulnerabilities (USN-350-1)

This update upgrades Thunderbird from 1.0.8 to 1.5.0.7. This step was necessary since the 1.0.x series is not supported by upstream any more. Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious email...

Ubuntu 6.06 LTS : mozilla-thunderbird vulnerabilities (USN-329-1)

Various flaws have been reported that allow an attacker to execute arbitrary code with user privileges by tricking the user into opening a malicious email containing JavaScript. Please note that JavaScript is disabled by default for emails, and it is not recommended to enable it. CVE-2006-3113,...

Fedora 7 : thunderbird-2.0.0.5-1.fc7 (2007-1180)

Mozilla Thunderbird is a standalone mail and newsgroup client. Several flaws were found in the way Thunderbird processed certain malformed JavaScript code. A malicious HTML email message containing JavaScript code could cause Thunderbird to crash or potentially execute arbitrary code as the user...

[SECURITY] Fedora Core 6 Update: thunderbird-1.5.0.12-3.fc6

Mozilla Thunderbird is a standalone mail and newsgroup client...

IE和Firefox浏览器Digest认证请求拆分漏洞

BUGTRAQ ID: 23668 CVECAN ID: CVE-2007-2292 IE和Firefox都是流行的WEB浏览器。 IE和Firefox在处理Digest认证方式时存在漏洞，可能导致验证失败。 如果用户使用Digest认证通过HTTP请求登录到网站的话，Firefox和IE可能无法正确地验证用户ID。恶意的网页可能在用户ID中包含有换行字符（%0a）注入头数据，如果用户通过代理进行连接的话代理就可能将认证请求解释为两个独立的请求，导致注入任意HTTP头。 Microsoft Internet Explorer 7.0.5730.11 Mozilla Thunderbird...

USN-536-1: Thunderbird vulnerabilities

Various flaws were discovered in the layout and JavaScript engines. By tricking a user into opening a malicious web page, an attacker could execute arbitrary code with the user's privileges. CVE-2007-5339, CVE-2007-5340 Flaws were discovered in the file upload form control. By tricking a user int...

thunderbird security update

CentOS Errata and Security Advisory CESA-2007:0981 Updated thunderbird packages that fix several security bugs are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Mozilla Thunderbird is a...