rPSA-2007-0157-1 firefox thunderbird

rPath Security Advisory: 2007-0157-1
Published: 2007-08-10
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:

    Indirect User Non-deterministic Unauthorized Access Updated Versions:

    firefox=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1     thunderbird=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1

References:

    
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844
    
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845
    
https://issues.rpath.com/browse/RPL-1600

Description:

    Previous versions of the firefox and thunderbird packages are     vulnerable to multiple attacks. One is a weakness that makes it hard     for add-ons to defend against a user-assisted privilege escalation     attack; the other can in some cases allow a user-assisted attacker     to run possibly arbitrary programs as the user running firefox     or thunderbird.     

    As the 1.5.0.x versions of firefox and thunderbird are no longer     being maintained, the new versions of the firefox and thunderbird     packages are new major versions. Of particular note, some firefox     add-ons that are no longer maintained may no longer function with     the new version of firefox.

Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License. A copy is available at http://www.rpath.com/permanent/mit-license.html Received on Fri Aug 10 12:34:31 2007

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek