[ MDVSA-2009:217-3 ] mozilla-thunderbird

[dude67]

_______________________________________________________________________

Package : mozilla-thunderbird
Date : December 3, 2009
Affected: 2008.0
_______________________________________________________________________

Problem Description:

A number of security vulnerabilities have been discovered in Mozilla
Thunderbird:

Security issues in thunderbird could lead to a man-in-the-middle
attack via a spoofed X.509 certificate (CVE-2009-2408).

A vulnerability was found in xmltok_impl.c (expat) that with
specially crafted XML could be exploited and lead to a denial of
service attack. Related to CVE-2009-2625 (CVE-2009-3720).

This update provides the latest version of Thunderbird which are not
vulnerable to these issues.

Update:

Packages for 2008.0 are being provided due to extended support for
Corporate products.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-2408
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3720
http://www.mozilla.org/security/announc ... 09-42.html
https://bugs.gentoo.org/show_bug.cgi?id=280615
_______________________________________________________________________