mozilla-thunderbird多个安全漏洞

🗓️ 10 Oct 2009 00:00:00Reported by RootType

Mozilla Thunderbird security update for CVE-2009-2408 and CVE-2009-262

Reporter	Title	Published	Views	Family All 683
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance - Identity Manager has multiple vulnerabilities	11 Jul 202407:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect embedded rules in IBM Business Automation Workflow	11 Jan 202413:32	–	ibm
IBM Security Bulletins	Security Bulletin: Addressing the Security vulnerability CVE-2022-23437,CVE-2009-2625,CVE-2012-0881,CVE-2013-4002 found in xercesImpl-2.9.1.jar and its previous versions affects ITCAM for Transactions	30 Aug 202311:09	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Xerces2 affect IBM Storage Protect Client, IBM Storage Protect for Virtual Environments, and IBM Storage Protect for Space Management (CVE-2013-4002, CVE-2012-1724, CVE-2012-0881, CVE-2022-23437, CVE-2009-2625)	13 Jul 202313:21	–	ibm
IBM Security Bulletins	Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable org.apache.xerces_2.9.0.v201101211617-4.8.0.jar	8 May 202308:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager May 2023 - Multiple CVEs	7 Jun 202307:18	–	ibm
IBM Security Bulletins	Security Bulletin: Order Management is subject to vulnerabilities regarding XML service where a remote attacker could exploit this vulnerability.	12 Apr 202417:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Call Center is subject to vulnerability regarding an XML service, a remote attacker could exploit this vulnerability to consume available CPU resources.	12 Apr 202417:47	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Content Navigator is affected by Apache Xerces2	29 Mar 202623:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm


                                                -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                       MDVSA-2009:217-1
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : mozilla-thunderbird
 Date    : August 23, 2009
 Affected: 2009.1
 _______________________________________________________________________

 Problem Description:

 A number of security vulnerabilities have been discovered in Mozilla
 Thunderbird:
 
 Security issues in thunderbird could lead to a man-in-the-middle
 attack via a spoofed X.509 certificate (CVE-2009-2408).
 
 A vulnerability was found in xmltok_impl.c (expat) that with
 specially crafted XML could be exploited and lead to a denial of
 service attack. Related to CVE-2009-2625.
 
 This update provides the latest version of Thunderbird which are not
 vulnerable to these issues.

 Update:

 The mozilla-thunderbird-moztraybiff packages had the wrong release
 which prevented it to be upgraded (#53129). The new packages addresses
 this problem.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
 http://www.mozilla.org/security/announce/2009/mfsa2009-42.html
 https://bugs.gentoo.org/show_bug.cgi?id=280615
 https://qa.mandriva.com/53129
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.1:
 e1c540f94c8b66fa4495de6015ed85db  \
2009.1/i586/mozilla-thunderbird-moztraybiff-1.2.4-4.1mdv2009.1.i586.rpm   \
ab2fa7586f21de2f23216def8c542db6  \
2009.1/SRPMS/mozilla-thunderbird-moztraybiff-1.2.4-4.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 b9ff59f0c11d63a1234365ea55ed5f46  \
2009.1/x86_64/mozilla-thunderbird-moztraybiff-1.2.4-4.1mdv2009.1.x86_64.rpm   \
ab2fa7586f21de2f23216def8c542db6  \
2009.1/SRPMS/mozilla-thunderbird-moztraybiff-1.2.4-4.1mdv2009.1.src.rpm  \
_______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  &lt;security*mandriva.com&gt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKzcjqmqjQ0CJFipgRArPoAKDTymDqJYIxV5BbT+2AwZppDwJIpACeJ4ht
VW9XZMiWqP+lDv+zVbOlvnY=
=ruxq
-----END PGP SIGNATURE-----

10 Oct 2009 00:00Current

6.9Medium risk

Vulners AI Score6.9

EPSS0.3038