[ MDVSA-2009:217-1 ] mozilla-thunderbird

[dude67]

_______________________________________________________________________

Package : mozilla-thunderbird
Date : August 23, 2009
Affected: 2009.1
_______________________________________________________________________

Problem Description:

A number of security vulnerabilities have been discovered in Mozilla
Thunderbird:

Security issues in thunderbird could lead to a man-in-the-middle
attack via a spoofed X.509 certificate (CVE-2009-2408).

A vulnerability was found in xmltok_impl.c (expat) that with
specially crafted XML could be exploited and lead to a denial of
service attack. Related to CVE-2009-2625.

This update provides the latest version of Thunderbird which are not
vulnerable to these issues.

Update:

The mozilla-thunderbird-moztraybiff packages had the wrong release
which prevented it to be upgraded (#53129). The new packages addresses
this problem.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-2408
http://www.mozilla.org/security/announc ... 09-42.html
https://bugs.gentoo.org/show_bug.cgi?id=280615
https://qa.mandriva.com/53129
_______________________________________________________________________