-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:076
http://www.mandriva.com/security/
_______________________________________________________________________
Package : mozilla
Date : April 25, 2006
Affected: Corporate 3.0
_______________________________________________________________________
Problem Description:
A number of vulnerabilities have been discovered in the Mozilla Suite
that could allow a remote attacker to craft malicious web pages that
could take advantage of these issues to execute arbitrary code with
elevated privileges, spoof content, and steal local files, cookies, or
other information from web pages. As well, some of these
vulnerabilities can be exploited to execute arbitrary code with the
privileges of the user running the browser.
As well, two crasher bugs have been fixed as well.
The updated packages have been patched to fix these problems.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790
https://bugzilla.mozilla.org/show_bug.cgi?id=275896
https://bugzilla.mozilla.org/show_bug.cgi?id=330900
_______________________________________________________________________
Updated Packages:
Corporate 3.0:
81dce00119439ab171593eb2976fe547
corporate/3.0/RPMS/libnspr4-1.7.8-0.8.C30mdk.i586.rpm
c0e04b64accc75483ca0795af33562be
corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.8.C30mdk.i586.rpm
288e4e8379aa0d7cc56327ba60035e0a
corporate/3.0/RPMS/libnss3-1.7.8-0.8.C30mdk.i586.rpm
c1bac96a978df5d75cfd7887a09144d5
corporate/3.0/RPMS/libnss3-devel-1.7.8-0.8.C30mdk.i586.rpm
0d06c6a4520068a368cf48e3f407c74e
corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.i586.rpm
73f9e85c4556834db6ef9333b98beef0
corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.i586.rpm
6939f71693b40125b5c3dd0534441d4a
corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.i586.rpm
cb3df735d1ce023dd9cfeed26889c91b
corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.i586.rpm
7aee6465cb0a42c6561b3c3deac96c8d
corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.i586.rpm
01ec6255f2071d246ef76a11b2844c8e
corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.i586.rpm
8d4075f4c1c9cd4f613a68ff15f09d85
corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.i586.rpm
cc4bcc8c9c19557513ef30d96150b9fe
corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.i586.rpm
05ab0503358b30c10dba88bb916473be
corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.i586.rpm
ddccba24ecfaa9f82167a7bb5c9c71ad
corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm
Corporate 3.0/X86_64:
9a8e62df1100fa84600706050870a63e
x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.8.C30mdk.x86_64.rpm
17c9c8233a462fc91061554c0a0ef451
x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.8.C30mdk.x86_64.rpm
efa25dec22975bab70c748d07e0a3c75
x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.8.C30mdk.x86_64.rpm
38de0287eaf7ed9f2e319cbcc042dcdf
x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.8.C30mdk.x86_64.rpm
18393cfe8c07b958e52a6f0f2b506e53
x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.x86_64.rpm
e6aea2fc34c466383781cb6487964cc0
x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.x86_64.rpm
be9a4c7519f064b07b48ea9556866f74
x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.x86_64.rpm
085cc65fea8f657875c5024c0d964a5d
x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.x86_64.rpm
1b6244b6bf96093518937ccf8dcd33c6
x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.x86_64.rpm
e66333a5573e85f32effe85a01a64a27
x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.x86_64.rpm
4bfb009ca3dcdc90ff1eb2f244cafdc4
x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.x86_64.rpm
caddf105e2756d3bebf74ad2f4e8a0d6
x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.x86_64.rpm
f1551cc11e1e75be6d25cf2f53070ac0
x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.x86_64.rpm
ddccba24ecfaa9f82167a7bb5c9c71ad
x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFETnBTmqjQ0CJFipgRArcTAKDcxTz/GNX8kqak3RR/7w24zwM07gCgiFlz
qBCSTPZ9EPi5eHFsxhS4f2A=
=n4oP
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
