rPath Security Advisory: 2007-0157-1
Published: 2007-08-10
Products: rPath Linux 1
Rating: Severe
Exposure Level Classification:
Indirect User Non-deterministic Unauthorized Access
Updated Versions:
firefox=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1
thunderbird=/conary.rpath.com@rpl:devel//1/2.0.0.6-0.1-1
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3844
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3845
https://issues.rpath.com/browse/RPL-1600
Description:
Previous versions of the firefox and thunderbird packages are
vulnerable to multiple attacks. One is a weakness that makes it hard
for add-ons to defend against a user-assisted privilege escalation
attack; the other can in some cases allow a user-assisted attacker
to run possibly arbitrary programs as the user running firefox
or thunderbird.
As the 1.5.0.x versions of firefox and thunderbird are no longer
being maintained, the new versions of the firefox and thunderbird
packages are new major versions. Of particular note, some firefox
add-ons that are no longer maintained may no longer function with
the new version of firefox.
Copyright 2007 rPath, Inc.
This file is distributed under the terms of the MIT License.
A copy is available at http://www.rpath.com/permanent/mit-license.html
