-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2006:076 http://www.mandriva.com/security/ _______________________________________________________________________ Package : mozilla Date : April 25, 2006 Affected: Corporate 3.0 _______________________________________________________________________ Problem Description: A number of vulnerabilities have been discovered in the Mozilla Suite that could allow a remote attacker to craft malicious web pages that could take advantage of these issues to execute arbitrary code with elevated privileges, spoof content, and steal local files, cookies, or other information from web pages. As well, some of these vulnerabilities can be exploited to execute arbitrary code with the privileges of the user running the browser. As well, two crasher bugs have been fixed as well. The updated packages have been patched to fix these problems. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790 https://bugzilla.mozilla.org/show_bug.cgi?id=275896 https://bugzilla.mozilla.org/show_bug.cgi?id=330900 _______________________________________________________________________ Updated Packages: Corporate 3.0: 81dce00119439ab171593eb2976fe547 corporate/3.0/RPMS/libnspr4-1.7.8-0.8.C30mdk.i586.rpm c0e04b64accc75483ca0795af33562be corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.8.C30mdk.i586.rpm 288e4e8379aa0d7cc56327ba60035e0a corporate/3.0/RPMS/libnss3-1.7.8-0.8.C30mdk.i586.rpm c1bac96a978df5d75cfd7887a09144d5 corporate/3.0/RPMS/libnss3-devel-1.7.8-0.8.C30mdk.i586.rpm 0d06c6a4520068a368cf48e3f407c74e corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.i586.rpm 73f9e85c4556834db6ef9333b98beef0 corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.i586.rpm 6939f71693b40125b5c3dd0534441d4a corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.i586.rpm cb3df735d1ce023dd9cfeed26889c91b corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.i586.rpm 7aee6465cb0a42c6561b3c3deac96c8d corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.i586.rpm 01ec6255f2071d246ef76a11b2844c8e corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.i586.rpm 8d4075f4c1c9cd4f613a68ff15f09d85 corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.i586.rpm cc4bcc8c9c19557513ef30d96150b9fe corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.i586.rpm 05ab0503358b30c10dba88bb916473be corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.i586.rpm ddccba24ecfaa9f82167a7bb5c9c71ad corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm Corporate 3.0/X86_64: 9a8e62df1100fa84600706050870a63e x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.8.C30mdk.x86_64.rpm 17c9c8233a462fc91061554c0a0ef451 x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.8.C30mdk.x86_64.rpm efa25dec22975bab70c748d07e0a3c75 x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.8.C30mdk.x86_64.rpm 38de0287eaf7ed9f2e319cbcc042dcdf x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.8.C30mdk.x86_64.rpm 18393cfe8c07b958e52a6f0f2b506e53 x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.x86_64.rpm e6aea2fc34c466383781cb6487964cc0 x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.x86_64.rpm be9a4c7519f064b07b48ea9556866f74 x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.x86_64.rpm 085cc65fea8f657875c5024c0d964a5d x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.x86_64.rpm 1b6244b6bf96093518937ccf8dcd33c6 x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.x86_64.rpm e66333a5573e85f32effe85a01a64a27 x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.x86_64.rpm 4bfb009ca3dcdc90ff1eb2f244cafdc4 x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.x86_64.rpm caddf105e2756d3bebf74ad2f4e8a0d6 x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.x86_64.rpm f1551cc11e1e75be6d25cf2f53070ac0 x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.x86_64.rpm ddccba24ecfaa9f82167a7bb5c9c71ad x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFETnBTmqjQ0CJFipgRArcTAKDcxTz/GNX8kqak3RR/7w24zwM07gCgiFlz qBCSTPZ9EPi5eHFsxhS4f2A= =n4oP -----END PGP SIGNATURE-----
