===========================================================
Ubuntu Security Notice USN-400-1 January 04, 2007
mozilla-thunderbird vulnerabilities
CVE-2006-6497, CVE-2006-6498, CVE-2006-6499, CVE-2006-6501,
CVE-2006-6502, CVE-2006-6503, CVE-2006-6505
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
mozilla-thunderbird 1.5.0.9-0ubuntu0.5.10
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.5.10
Ubuntu 6.06 LTS:
mozilla-thunderbird 1.5.0.9-0ubuntu0.6.06
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.6.06
Ubuntu 6.10:
mozilla-thunderbird 1.5.0.9-0ubuntu0.6.10
mozilla-thunderbird-dev 1.5.0.9-0ubuntu0.6.10
After a standard system upgrade you need to restart Thunderbird to
effect the necessary changes.
Details follow:
Georgi Guninski and David Bienvenu discovered that long Content-Type and
RFC2047-encoded headers we vulnerable to heap overflows. By tricking
the user into opening a specially crafted email, an attacker could
execute arbitrary code with user privileges. (CVE-2006-6506)
Various flaws have been reported that allow an attacker to execute
arbitrary code with user privileges or bypass internal XSS protections
by tricking the user into opening a malicious email containing
JavaScript. Please note that JavaScript is disabled by default for
emails, and it is not recommended to enable it. (CVE-2006-6497,
CVE-2006-6498, CVE-2006-6499, CVE-2006-6501, CVE-2006-6502,
CVE-2006-6503)
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10.diff.gz
Size/MD5: 451886 9f56038195cbfd504e30d728afffd839
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10.dsc
Size/MD5: 960 9355d95244a407ed2e186cebeec17227
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.5.10_amd64.deb
Size/MD5: 3527900 d42e7fe575f44c47df2be82c8822f118
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.5.10_amd64.deb
Size/MD5: 190564 84bc6710da5797f6d2602ee4e1706c03
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.5.10_amd64.deb
Size/MD5: 55790 3c54969a4c202ad37a22852dc09218fa
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10_amd64.deb
Size/MD5: 11992084 d6f7b1e835dc1698fa7b9b610eb774d7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.5.10_i386.deb
Size/MD5: 3519308 e36f9544ba777426ff48cd6cd98598b7
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.5.10_i386.deb
Size/MD5: 183926 071d1aeb37a7be4b270ad72d8e3fe83e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.5.10_i386.deb
Size/MD5: 51408 edb40af1565a0ad0449172dffc05bdf2
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10_i386.deb
Size/MD5: 10301946 1d5a89a3c62003e78bb524470d1df0bd
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.5.10_powerpc.deb
Size/MD5: 3524840 bf72063909f218ea644be71bb24fa978
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.5.10_powerpc.deb
Size/MD5: 187280 0c2a5965a1f167ebd39ed2ac510dd25f
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.5.10_powerpc.deb
Size/MD5: 54980 3eaf7a9964f9fe19e394497d2d011c91
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10_powerpc.deb
Size/MD5: 11544152 03bba83cdba82a9d3cf5668f5481fa3f
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.5.10_sparc.deb
Size/MD5: 3521026 fce40c573d51c4ec6ed7e1bba5d3371b
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.5.10_sparc.deb
Size/MD5: 184710 6a69cad59a1296f6c937f32e936759c2
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.5.10_sparc.deb
Size/MD5: 52872 d2cb21977046d1e02596ddbe349712c1
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.5.10_sparc.deb
Size/MD5: 10782152 b4408f24a49a98056ae912ecc5bcb245
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06.diff.gz
Size/MD5: 455145 8e3dd9a42c535cf3dbbfa7d3f43c10d4
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06.dsc
Size/MD5: 960 b80db5c275a3c7f4a2ea7842e17fec6d
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.06_amd64.deb
Size/MD5: 3532510 5592350d1dd0bb6b70394b14f8fde2c2
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.06_amd64.deb
Size/MD5: 194024 e5871c35e2aef3f1768b447019b379f1
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.06_amd64.deb
Size/MD5: 59274 79e2c030c89eb8297d1ff24a7597b6d7
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06_amd64.deb
Size/MD5: 12001616 02611be9890cbfccd812db689cb94e19
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.06_i386.deb
Size/MD5: 3524028 aa54f8fb63106674dc23514edf7f452e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.06_i386.deb
Size/MD5: 187396 a0d317c47f12847d79cba7c6393100e9
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.06_i386.deb
Size/MD5: 54784 af53dd218d88562c6daaabfbf6e2eb28
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06_i386.deb
Size/MD5: 10300500 7703c64dd2d715a77fd1ee8e7d4106af
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.06_powerpc.deb
Size/MD5: 3530092 ae5f0e37440660e41982ae2d879d5a1c
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.06_powerpc.deb
Size/MD5: 190730 fd4a74ad4c46b884420187435095f986
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.06_powerpc.deb
Size/MD5: 58386 6159f387a03d0a328ff3c077e259700f
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06_powerpc.deb
Size/MD5: 11572978 4da87cee0aa4392bb9172ffca7d5cbd3
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.06_sparc.deb
Size/MD5: 3525958 21c5b90c693a918e435ec19dac264768
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.06_sparc.deb
Size/MD5: 188194 88f2e1008358728615ffe26a2671d4cc
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.06_sparc.deb
Size/MD5: 56276 ee1009439286856271c676fdb8abecf8
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.06_sparc.deb
Size/MD5: 10772130 2798c0f5b0ed07c22f783ea321f18757
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10.diff.gz
Size/MD5: 455145 bd31793ada82bc8f7f188fce4996ad94
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10.dsc
Size/MD5: 960 3954fe275c0b3a6fbc4069e85d27ce87
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9.orig.tar.gz
Size/MD5: 35610990 511100300f92ef07dc733c5f0a8aadf6
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.10_amd64.deb
Size/MD5: 3532362 6f54066cee692a33b4261eda37c77f7a
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.10_amd64.deb
Size/MD5: 194160 49fe3e145ccd8986d089e6625de45a42
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.10_amd64.deb
Size/MD5: 59302 5437dc8ca65ddcbe1b54269ecca513d1
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10_amd64.deb
Size/MD5: 11996524 c592f4f62e077ee6832d752f1630c9f1
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.10_i386.deb
Size/MD5: 3528062 4009f219f4ebbb0b57a9ea809eef8fdd
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.10_i386.deb
Size/MD5: 188812 70ec0e513c5ff23ee5ea1ae9b6f146b7
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.10_i386.deb
Size/MD5: 55920 1700eb2f625cc68c58ecd64c6b52918e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10_i386.deb
Size/MD5: 10756290 43b607dd453f4f2344f9631c7883a45b
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.10_powerpc.deb
Size/MD5: 3530100 39a904eea3487e877ed89099b093182e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.10_powerpc.deb
Size/MD5: 191248 89fd5cfb1d7ce4232714bad58cc8c4e5
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.10_powerpc.deb
Size/MD5: 58958 e8883e10a4adc2d5175faa4871c45db3
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10_powerpc.deb
Size/MD5: 11702722 9e1ac70b40fadc13540ed8e1346ebd96
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.5.0.9-0ubuntu0.6.10_sparc.deb
Size/MD5: 3526070 8a172512a876f136335b42ec2fb64b5e
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.5.0.9-0ubuntu0.6.10_sparc.deb
Size/MD5: 188646 efee0c9e23d240797f5963223a8e27a3
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.5.0.9-0ubuntu0.6.10_sparc.deb
Size/MD5: 56344 74beaea8578051a5f1cf4e0acf6a93c1
http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.5.0.9-0ubuntu0.6.10_sparc.deb
Size/MD5: 10969616 0327abc5d649e757c03e5763b2469bce
Attachment:
signature.asc
Description: Digital signature