[ MDVSA-2010:051 ] mozilla-thunderbird

[dude67]

_______________________________________________________________________

Package : mozilla-thunderbird
Date : March 1, 2010
Affected: 2008.0, 2009.1, 2010.0
_______________________________________________________________________

Problem Description:

A vulnerabilitiy has been found and corrected in mozilla-thunderbird:

Security researcher Alin Rad Pop of Secunia Research reported that
the HTML parser incorrectly freed used memory when insufficient space
was available to process remaining input. Under such circumstances,
memory occupied by in-use objects was freed and could later be filled
with attacker-controlled text. These conditions could result in the
execution or arbitrary code if methods on the freed objects were
subsequently called (CVE-2009-1571).

Packages for 2008.0 are provided for Corporate Desktop 2008.0
customers.

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1571
http://www.mozilla.org/security/announc ... 10-03.html
_______________________________________________________________________