Red Hat has released 5 security updates for Red Hat Enterprise Linux: [RHSA-2011:1167-01] Critical: seamonkey security update, [RHSA-2011:1165-01] Critical: thunderbird security update, [RHSA-2011:1164-01] Critical: firefox security update, [RHSA-2011:1163-01] Important: kernel security and bug fix update, and [RHSA-2011:1166-01] Critical: thunderbird security update
[RHSA-2011:1167-01] Critical: seamonkey security update
[RHSA-2011:1167-01] Critical: seamonkey security update
[RHSA-2011:1165-01] Critical: thunderbird security update
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: seamonkey security update
Advisory ID: RHSA-2011:1167-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1167.html
Issue date: 2011-08-16
CVE Names: CVE-2011-2982 CVE-2011-2983
=====================================================================
1. Summary:
Updated seamonkey packages that fix several security issues are now
available for Red Hat Enterprise Linux 4.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
SeaMonkey is an open source web browser, email and newsgroup client, IRC
chat client, and HTML editor.
Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause SeaMonkey to crash or,
potentially, execute arbitrary code with the privileges of the user running
SeaMonkey. (CVE-2011-2982)
A flaw was found in the way SeaMonkey handled malformed JavaScript. A web
page containing malicious JavaScript could cause SeaMonkey to access
already freed memory, causing SeaMonkey to crash or, potentially, execute
arbitrary code with the privileges of the user running SeaMonkey.
(CVE-2011-2983)
All SeaMonkey users should upgrade to these updated packages, which correct
these issues. After installing the update, SeaMonkey must be restarted for
the changes to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
730518 - CVE-2011-2982 Mozilla: Miscellaneous memory safety hazards
730523 - CVE-2011-2983 Mozilla: Private data leakage using RegExp.input
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/seamonkey-1.0.9-72.el4.src.rpm
i386:
seamonkey-1.0.9-72.el4.i386.rpm
seamonkey-chat-1.0.9-72.el4.i386.rpm
seamonkey-debuginfo-1.0.9-72.el4.i386.rpm
seamonkey-devel-1.0.9-72.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-72.el4.i386.rpm
seamonkey-js-debugger-1.0.9-72.el4.i386.rpm
seamonkey-mail-1.0.9-72.el4.i386.rpm
ia64:
seamonkey-1.0.9-72.el4.ia64.rpm
seamonkey-chat-1.0.9-72.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-72.el4.ia64.rpm
seamonkey-devel-1.0.9-72.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-72.el4.ia64.rpm
seamonkey-mail-1.0.9-72.el4.ia64.rpm
ppc:
seamonkey-1.0.9-72.el4.ppc.rpm
seamonkey-chat-1.0.9-72.el4.ppc.rpm
seamonkey-debuginfo-1.0.9-72.el4.ppc.rpm
seamonkey-devel-1.0.9-72.el4.ppc.rpm
seamonkey-dom-inspector-1.0.9-72.el4.ppc.rpm
seamonkey-js-debugger-1.0.9-72.el4.ppc.rpm
seamonkey-mail-1.0.9-72.el4.ppc.rpm
s390:
seamonkey-1.0.9-72.el4.s390.rpm
seamonkey-chat-1.0.9-72.el4.s390.rpm
seamonkey-debuginfo-1.0.9-72.el4.s390.rpm
seamonkey-devel-1.0.9-72.el4.s390.rpm
seamonkey-dom-inspector-1.0.9-72.el4.s390.rpm
seamonkey-js-debugger-1.0.9-72.el4.s390.rpm
seamonkey-mail-1.0.9-72.el4.s390.rpm
s390x:
seamonkey-1.0.9-72.el4.s390x.rpm
seamonkey-chat-1.0.9-72.el4.s390x.rpm
seamonkey-debuginfo-1.0.9-72.el4.s390x.rpm
seamonkey-devel-1.0.9-72.el4.s390x.rpm
seamonkey-dom-inspector-1.0.9-72.el4.s390x.rpm
seamonkey-js-debugger-1.0.9-72.el4.s390x.rpm
seamonkey-mail-1.0.9-72.el4.s390x.rpm
x86_64:
seamonkey-1.0.9-72.el4.x86_64.rpm
seamonkey-chat-1.0.9-72.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-72.el4.x86_64.rpm
seamonkey-devel-1.0.9-72.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-72.el4.x86_64.rpm
seamonkey-mail-1.0.9-72.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/seamonkey-1.0.9-72.el4.src.rpm
i386:
seamonkey-1.0.9-72.el4.i386.rpm
seamonkey-chat-1.0.9-72.el4.i386.rpm
seamonkey-debuginfo-1.0.9-72.el4.i386.rpm
seamonkey-devel-1.0.9-72.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-72.el4.i386.rpm
seamonkey-js-debugger-1.0.9-72.el4.i386.rpm
seamonkey-mail-1.0.9-72.el4.i386.rpm
x86_64:
seamonkey-1.0.9-72.el4.x86_64.rpm
seamonkey-chat-1.0.9-72.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-72.el4.x86_64.rpm
seamonkey-devel-1.0.9-72.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-72.el4.x86_64.rpm
seamonkey-mail-1.0.9-72.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/seamonkey-1.0.9-72.el4.src.rpm
i386:
seamonkey-1.0.9-72.el4.i386.rpm
seamonkey-chat-1.0.9-72.el4.i386.rpm
seamonkey-debuginfo-1.0.9-72.el4.i386.rpm
seamonkey-devel-1.0.9-72.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-72.el4.i386.rpm
seamonkey-js-debugger-1.0.9-72.el4.i386.rpm
seamonkey-mail-1.0.9-72.el4.i386.rpm
ia64:
seamonkey-1.0.9-72.el4.ia64.rpm
seamonkey-chat-1.0.9-72.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-72.el4.ia64.rpm
seamonkey-devel-1.0.9-72.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-72.el4.ia64.rpm
seamonkey-mail-1.0.9-72.el4.ia64.rpm
x86_64:
seamonkey-1.0.9-72.el4.x86_64.rpm
seamonkey-chat-1.0.9-72.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-72.el4.x86_64.rpm
seamonkey-devel-1.0.9-72.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-72.el4.x86_64.rpm
seamonkey-mail-1.0.9-72.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/seamonkey-1.0.9-72.el4.src.rpm
i386:
seamonkey-1.0.9-72.el4.i386.rpm
seamonkey-chat-1.0.9-72.el4.i386.rpm
seamonkey-debuginfo-1.0.9-72.el4.i386.rpm
seamonkey-devel-1.0.9-72.el4.i386.rpm
seamonkey-dom-inspector-1.0.9-72.el4.i386.rpm
seamonkey-js-debugger-1.0.9-72.el4.i386.rpm
seamonkey-mail-1.0.9-72.el4.i386.rpm
ia64:
seamonkey-1.0.9-72.el4.ia64.rpm
seamonkey-chat-1.0.9-72.el4.ia64.rpm
seamonkey-debuginfo-1.0.9-72.el4.ia64.rpm
seamonkey-devel-1.0.9-72.el4.ia64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.ia64.rpm
seamonkey-js-debugger-1.0.9-72.el4.ia64.rpm
seamonkey-mail-1.0.9-72.el4.ia64.rpm
x86_64:
seamonkey-1.0.9-72.el4.x86_64.rpm
seamonkey-chat-1.0.9-72.el4.x86_64.rpm
seamonkey-debuginfo-1.0.9-72.el4.x86_64.rpm
seamonkey-devel-1.0.9-72.el4.x86_64.rpm
seamonkey-dom-inspector-1.0.9-72.el4.x86_64.rpm
seamonkey-js-debugger-1.0.9-72.el4.x86_64.rpm
seamonkey-mail-1.0.9-72.el4.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-2982.html
https://www.redhat.com/security/data/cve/CVE-2011-2983.html
https://access.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
[RHSA-2011:1164-01] Critical: firefox security update
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: thunderbird security update
Advisory ID: RHSA-2011:1165-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1165.html
Issue date: 2011-08-16
CVE Names: CVE-2011-2982 CVE-2011-2983
=====================================================================
1. Summary:
An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 4 and 5.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Optional Productivity Applications (v. 5 server) - i386, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Several flaws were found in the processing of malformed HTML content.
Malicious HTML content could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running
Thunderbird. (CVE-2011-2982)
A flaw was found in the way Thunderbird handled malformed JavaScript.
Malicious content could cause Thunderbird to access already freed memory,
causing Thunderbird to crash or, potentially, execute arbitrary code with
the privileges of the user running Thunderbird. (CVE-2011-2983)
Note: This update disables support for Scalable Vector Graphics (SVG)
images in Thunderbird on Red Hat Enterprise Linux 5.
All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
730518 - CVE-2011-2982 Mozilla: Miscellaneous memory safety hazards
730523 - CVE-2011-2983 Mozilla: Private data leakage using RegExp.input
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/thunderbird-1.5.0.12-40.el4.src.rpm
i386:
thunderbird-1.5.0.12-40.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-40.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.ia64.rpm
ppc:
thunderbird-1.5.0.12-40.el4.ppc.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.ppc.rpm
s390:
thunderbird-1.5.0.12-40.el4.s390.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.s390.rpm
s390x:
thunderbird-1.5.0.12-40.el4.s390x.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.s390x.rpm
x86_64:
thunderbird-1.5.0.12-40.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/thunderbird-1.5.0.12-40.el4.src.rpm
i386:
thunderbird-1.5.0.12-40.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.i386.rpm
x86_64:
thunderbird-1.5.0.12-40.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/thunderbird-1.5.0.12-40.el4.src.rpm
i386:
thunderbird-1.5.0.12-40.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-40.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.ia64.rpm
x86_64:
thunderbird-1.5.0.12-40.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/thunderbird-1.5.0.12-40.el4.src.rpm
i386:
thunderbird-1.5.0.12-40.el4.i386.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.i386.rpm
ia64:
thunderbird-1.5.0.12-40.el4.ia64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.ia64.rpm
x86_64:
thunderbird-1.5.0.12-40.el4.x86_64.rpm
thunderbird-debuginfo-1.5.0.12-40.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/thunderbird-2.0.0.24-21.el5.src.rpm
i386:
thunderbird-2.0.0.24-21.el5.i386.rpm
thunderbird-debuginfo-2.0.0.24-21.el5.i386.rpm
x86_64:
thunderbird-2.0.0.24-21.el5.x86_64.rpm
thunderbird-debuginfo-2.0.0.24-21.el5.x86_64.rpm
RHEL Optional Productivity Applications (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/thunderbird-2.0.0.24-21.el5.src.rpm
i386:
thunderbird-2.0.0.24-21.el5.i386.rpm
thunderbird-debuginfo-2.0.0.24-21.el5.i386.rpm
x86_64:
thunderbird-2.0.0.24-21.el5.x86_64.rpm
thunderbird-debuginfo-2.0.0.24-21.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-2982.html
https://www.redhat.com/security/data/cve/CVE-2011-2983.html
https://access.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
[RHSA-2011:1163-01] Important: kernel security and bug fix update
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: firefox security update
Advisory ID: RHSA-2011:1164-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1164.html
Issue date: 2011-08-16
CVE Names: CVE-2011-0084 CVE-2011-2378 CVE-2011-2981
CVE-2011-2982 CVE-2011-2983 CVE-2011-2984
=====================================================================
1. Summary:
Updated firefox packages that fix several security issues are now available
for Red Hat Enterprise Linux 4, 5, and 6.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64
3. Description:
Mozilla Firefox is an open source web browser. XULRunner provides the XUL
Runtime environment for Mozilla Firefox.
Several flaws were found in the processing of malformed web content. A web
page containing malicious content could cause Firefox to crash or,
potentially, execute arbitrary code with the privileges of the user running
Firefox. (CVE-2011-2982)
A dangling pointer flaw was found in the Firefox Scalable Vector Graphics
(SVG) text manipulation routine. A web page containing a malicious SVG
image could cause Firefox to crash or, potentially, execute arbitrary code
with the privileges of the user running Firefox. (CVE-2011-0084)
A dangling pointer flaw was found in the way Firefox handled a certain
Document Object Model (DOM) element. A web page containing malicious
content could cause Firefox to crash or, potentially, execute arbitrary
code with the privileges of the user running Firefox. (CVE-2011-2378)
A flaw was found in the event management code in Firefox. A website
containing malicious JavaScript could cause Firefox to execute that
JavaScript with the privileges of the user running Firefox. (CVE-2011-2981)
A flaw was found in the way Firefox handled malformed JavaScript. A web
page containing malicious JavaScript could cause Firefox to access already
freed memory, causing Firefox to crash or, potentially, execute arbitrary
code with the privileges of the user running Firefox. (CVE-2011-2983)
It was found that a malicious web page could execute arbitrary code with
the privileges of the user running Firefox if the user dropped a tab onto
the malicious web page. (CVE-2011-2984)
For technical details regarding these flaws, refer to the Mozilla security
advisories for Firefox 3.6.20. You can find a link to the Mozilla
advisories in the References section of this erratum.
All Firefox users should upgrade to these updated packages, which contain
Firefox version 3.6.20, which corrects these issues. After installing the
update, Firefox must be restarted for the changes to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
730518 - CVE-2011-2982 Mozilla: Miscellaneous memory safety hazards
730519 - CVE-2011-0084 Mozilla: Crash in SVGTextElement.getCharNumAtPosition()
730520 - CVE-2011-2981 Mozilla: Privilege escalation using event handlers
730521 - CVE-2011-2378 Mozilla: Dangling pointer vulnerability in appendChild
730522 - CVE-2011-2984 Mozilla: Privilege escalation dropping a tab element in content area
730523 - CVE-2011-2983 Mozilla: Private data leakage using RegExp.input
6. Package List:
Red Hat Enterprise Linux AS version 4:
Source:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/firefox-3.6.20-2.el4.src.rpm
i386:
firefox-3.6.20-2.el4.i386.rpm
firefox-debuginfo-3.6.20-2.el4.i386.rpm
ia64:
firefox-3.6.20-2.el4.ia64.rpm
firefox-debuginfo-3.6.20-2.el4.ia64.rpm
ppc:
firefox-3.6.20-2.el4.ppc.rpm
firefox-debuginfo-3.6.20-2.el4.ppc.rpm
s390:
firefox-3.6.20-2.el4.s390.rpm
firefox-debuginfo-3.6.20-2.el4.s390.rpm
s390x:
firefox-3.6.20-2.el4.s390x.rpm
firefox-debuginfo-3.6.20-2.el4.s390x.rpm
x86_64:
firefox-3.6.20-2.el4.x86_64.rpm
firefox-debuginfo-3.6.20-2.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
Source:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/firefox-3.6.20-2.el4.src.rpm
i386:
firefox-3.6.20-2.el4.i386.rpm
firefox-debuginfo-3.6.20-2.el4.i386.rpm
x86_64:
firefox-3.6.20-2.el4.x86_64.rpm
firefox-debuginfo-3.6.20-2.el4.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
Source:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/firefox-3.6.20-2.el4.src.rpm
i386:
firefox-3.6.20-2.el4.i386.rpm
firefox-debuginfo-3.6.20-2.el4.i386.rpm
ia64:
firefox-3.6.20-2.el4.ia64.rpm
firefox-debuginfo-3.6.20-2.el4.ia64.rpm
x86_64:
firefox-3.6.20-2.el4.x86_64.rpm
firefox-debuginfo-3.6.20-2.el4.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
Source:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/firefox-3.6.20-2.el4.src.rpm
i386:
firefox-3.6.20-2.el4.i386.rpm
firefox-debuginfo-3.6.20-2.el4.i386.rpm
ia64:
firefox-3.6.20-2.el4.ia64.rpm
firefox-debuginfo-3.6.20-2.el4.ia64.rpm
x86_64:
firefox-3.6.20-2.el4.x86_64.rpm
firefox-debuginfo-3.6.20-2.el4.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/firefox-3.6.20-2.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.20-2.el5.src.rpm
i386:
firefox-3.6.20-2.el5.i386.rpm
firefox-debuginfo-3.6.20-2.el5.i386.rpm
xulrunner-1.9.2.20-2.el5.i386.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
x86_64:
firefox-3.6.20-2.el5.i386.rpm
firefox-3.6.20-2.el5.x86_64.rpm
firefox-debuginfo-3.6.20-2.el5.i386.rpm
firefox-debuginfo-3.6.20-2.el5.x86_64.rpm
xulrunner-1.9.2.20-2.el5.i386.rpm
xulrunner-1.9.2.20-2.el5.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/xulrunner-1.9.2.20-2.el5.src.rpm
i386:
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
xulrunner-devel-1.9.2.20-2.el5.i386.rpm
x86_64:
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el5.i386.rpm
xulrunner-devel-1.9.2.20-2.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/firefox-3.6.20-2.el5.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/xulrunner-1.9.2.20-2.el5.src.rpm
i386:
firefox-3.6.20-2.el5.i386.rpm
firefox-debuginfo-3.6.20-2.el5.i386.rpm
xulrunner-1.9.2.20-2.el5.i386.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
xulrunner-devel-1.9.2.20-2.el5.i386.rpm
ia64:
firefox-3.6.20-2.el5.ia64.rpm
firefox-debuginfo-3.6.20-2.el5.ia64.rpm
xulrunner-1.9.2.20-2.el5.ia64.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.ia64.rpm
xulrunner-devel-1.9.2.20-2.el5.ia64.rpm
ppc:
firefox-3.6.20-2.el5.ppc.rpm
firefox-debuginfo-3.6.20-2.el5.ppc.rpm
xulrunner-1.9.2.20-2.el5.ppc.rpm
xulrunner-1.9.2.20-2.el5.ppc64.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.ppc.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.ppc64.rpm
xulrunner-devel-1.9.2.20-2.el5.ppc.rpm
xulrunner-devel-1.9.2.20-2.el5.ppc64.rpm
s390x:
firefox-3.6.20-2.el5.s390.rpm
firefox-3.6.20-2.el5.s390x.rpm
firefox-debuginfo-3.6.20-2.el5.s390.rpm
firefox-debuginfo-3.6.20-2.el5.s390x.rpm
xulrunner-1.9.2.20-2.el5.s390.rpm
xulrunner-1.9.2.20-2.el5.s390x.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.s390.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.s390x.rpm
xulrunner-devel-1.9.2.20-2.el5.s390.rpm
xulrunner-devel-1.9.2.20-2.el5.s390x.rpm
x86_64:
firefox-3.6.20-2.el5.i386.rpm
firefox-3.6.20-2.el5.x86_64.rpm
firefox-debuginfo-3.6.20-2.el5.i386.rpm
firefox-debuginfo-3.6.20-2.el5.x86_64.rpm
xulrunner-1.9.2.20-2.el5.i386.rpm
xulrunner-1.9.2.20-2.el5.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.i386.rpm
xulrunner-debuginfo-1.9.2.20-2.el5.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el5.i386.rpm
xulrunner-devel-1.9.2.20-2.el5.x86_64.rpm
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/firefox-3.6.20-2.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
x86_64:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-3.6.20-2.el6_1.x86_64.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.x86_64.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux Desktop Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
x86_64:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux HPC Node Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/firefox-3.6.20-2.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
x86_64:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-3.6.20-2.el6_1.x86_64.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.x86_64.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux Server (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/firefox-3.6.20-2.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
ppc64:
firefox-3.6.20-2.el6_1.ppc.rpm
firefox-3.6.20-2.el6_1.ppc64.rpm
firefox-debuginfo-3.6.20-2.el6_1.ppc.rpm
firefox-debuginfo-3.6.20-2.el6_1.ppc64.rpm
xulrunner-1.9.2.20-2.el6_1.ppc.rpm
xulrunner-1.9.2.20-2.el6_1.ppc64.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.ppc.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.ppc64.rpm
s390x:
firefox-3.6.20-2.el6_1.s390.rpm
firefox-3.6.20-2.el6_1.s390x.rpm
firefox-debuginfo-3.6.20-2.el6_1.s390.rpm
firefox-debuginfo-3.6.20-2.el6_1.s390x.rpm
xulrunner-1.9.2.20-2.el6_1.s390.rpm
xulrunner-1.9.2.20-2.el6_1.s390x.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.s390.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.s390x.rpm
x86_64:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-3.6.20-2.el6_1.x86_64.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.x86_64.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
ppc64:
xulrunner-debuginfo-1.9.2.20-2.el6_1.ppc.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.ppc64.rpm
xulrunner-devel-1.9.2.20-2.el6_1.ppc.rpm
xulrunner-devel-1.9.2.20-2.el6_1.ppc64.rpm
s390x:
xulrunner-debuginfo-1.9.2.20-2.el6_1.s390.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.s390x.rpm
xulrunner-devel-1.9.2.20-2.el6_1.s390.rpm
xulrunner-devel-1.9.2.20-2.el6_1.s390x.rpm
x86_64:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/firefox-3.6.20-2.el6_1.src.rpm
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
x86_64:
firefox-3.6.20-2.el6_1.i686.rpm
firefox-3.6.20-2.el6_1.x86_64.rpm
firefox-debuginfo-3.6.20-2.el6_1.i686.rpm
firefox-debuginfo-3.6.20-2.el6_1.x86_64.rpm
xulrunner-1.9.2.20-2.el6_1.i686.rpm
xulrunner-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
Red Hat Enterprise Linux Workstation Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/xulrunner-1.9.2.20-2.el6_1.src.rpm
i386:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
x86_64:
xulrunner-debuginfo-1.9.2.20-2.el6_1.i686.rpm
xulrunner-debuginfo-1.9.2.20-2.el6_1.x86_64.rpm
xulrunner-devel-1.9.2.20-2.el6_1.i686.rpm
xulrunner-devel-1.9.2.20-2.el6_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-0084.html
https://www.redhat.com/security/data/cve/CVE-2011-2378.html
https://www.redhat.com/security/data/cve/CVE-2011-2981.html
https://www.redhat.com/security/data/cve/CVE-2011-2982.html
https://www.redhat.com/security/data/cve/CVE-2011-2983.html
https://www.redhat.com/security/data/cve/CVE-2011-2984.html
https://access.redhat.com/security/updates/classification/#critical
http://www.mozilla.org/security/known-vulnerabilities/firefox36.html#firefox3.6.20
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
[RHSA-2011:1166-01] Critical: thunderbird security update
=====================================================================
Red Hat Security Advisory
Synopsis: Important: kernel security and bug fix update
Advisory ID: RHSA-2011:1163-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1163.html
Issue date: 2011-08-16
CVE Names: CVE-2011-1780 CVE-2011-2525
=====================================================================
1. Summary:
Updated kernel packages that fix two security issues and three bugs are now
available for Red Hat Enterprise Linux 5.6 Extended Update Support.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, noarch, ppc, s390x, x86_64
3. Description:
The kernel packages contain the Linux kernel, the core of any Linux
operating system.
This update includes backported fixes for two security issues. These issues
only affected users of Red Hat Enterprise Linux 5.6 Extended Update
Support, as they have already been addressed for users of Red Hat
Enterprise Linux 5 in the 5.7 update, RHSA-2011:1065.
This update fixes the following security issues:
* A flaw was found in the way the Xen hypervisor implementation handled
instruction emulation during virtual machine exits. A malicious user-space
process running in an SMP guest could trick the emulator into reading a
different instruction than the one that caused the virtual machine to exit.
An unprivileged guest user could trigger this flaw to crash the host. This
only affects systems with both an AMD x86 processor and the AMD
Virtualization (AMD-V) extensions enabled. (CVE-2011-1780, Important)
* A flaw allowed the tc_fill_qdisc() function in the Linux kernel's packet
scheduler API implementation to be called on built-in qdisc structures. A
local, unprivileged user could use this flaw to trigger a NULL pointer
dereference, resulting in a denial of service. (CVE-2011-2525, Moderate)
This update also fixes the following bugs:
* A bug was found in the way the x86_emulate() function handled the IMUL
instruction in the Xen hypervisor. On systems without support for hardware
assisted paging (HAP), such as those running CPUs that do not have support
for (or those that have it disabled) Intel Extended Page Tables (EPT) or
AMD Virtualization (AMD-V) Rapid Virtualization Indexing (RVI), this bug
could cause fully-virtualized guests to crash or lead to silent memory
corruption. In reported cases, this issue occurred when booting
fully-virtualized Red Hat Enterprise Linux 6.1 guests with memory cgroups
enabled. (BZ#712884)
* A bug in the way the ibmvscsi driver handled interrupts may have
prevented automatic path recovery for multipath devices. This bug only
affected 64-bit PowerPC systems. (BZ#720929)
* The RHSA-2009:1243 update introduced a regression in the way file locking
on NFS (Network File System) was handled. This caused applications to hang
if they made a lock request on a file on an NFS version 2 or 3 file system
that was mounted with the "sec=krb5" option. With this update, the original
behavior of using mixed RPC authentication flavors for NFS and locking
requests has been restored. (BZ#722854)
Users should upgrade to these updated packages, which contain backported
patches to resolve these issues. The system must be rebooted for this
update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
To install kernel packages manually, use "rpm -ivh [package]". Do not
use "rpm -Uvh" as that will remove the running kernel binaries from
your system. You may use "rpm -e" to remove old kernels after
determining that the new kernel functions properly on your system.
5. Bugs fixed (http://bugzilla.redhat.com/):
702657 - CVE-2011-1780 kernel: xen: svm: insufficiencies in handling emulated instructions during vm exits
712884 - RHEL6.1 32bit xen hvm guest crash randomly
719066 - [RHEL5.7][kernel-xen] HVM guests hang during installation on AMD systems
720552 - CVE-2011-2525 kernel: kernel: net_sched: fix qdisc_notify()
6. Package List:
Red Hat Enterprise Linux (v. 5 server):
Source:
kernel-2.6.18-238.21.1.el5.src.rpm
i386:
kernel-2.6.18-238.21.1.el5.i686.rpm
kernel-PAE-2.6.18-238.21.1.el5.i686.rpm
kernel-PAE-debuginfo-2.6.18-238.21.1.el5.i686.rpm
kernel-PAE-devel-2.6.18-238.21.1.el5.i686.rpm
kernel-debug-2.6.18-238.21.1.el5.i686.rpm
kernel-debug-debuginfo-2.6.18-238.21.1.el5.i686.rpm
kernel-debug-devel-2.6.18-238.21.1.el5.i686.rpm
kernel-debuginfo-2.6.18-238.21.1.el5.i686.rpm
kernel-debuginfo-common-2.6.18-238.21.1.el5.i686.rpm
kernel-devel-2.6.18-238.21.1.el5.i686.rpm
kernel-headers-2.6.18-238.21.1.el5.i386.rpm
kernel-xen-2.6.18-238.21.1.el5.i686.rpm
kernel-xen-debuginfo-2.6.18-238.21.1.el5.i686.rpm
kernel-xen-devel-2.6.18-238.21.1.el5.i686.rpm
ia64:
kernel-2.6.18-238.21.1.el5.ia64.rpm
kernel-debug-2.6.18-238.21.1.el5.ia64.rpm
kernel-debug-debuginfo-2.6.18-238.21.1.el5.ia64.rpm
kernel-debug-devel-2.6.18-238.21.1.el5.ia64.rpm
kernel-debuginfo-2.6.18-238.21.1.el5.ia64.rpm
kernel-debuginfo-common-2.6.18-238.21.1.el5.ia64.rpm
kernel-devel-2.6.18-238.21.1.el5.ia64.rpm
kernel-headers-2.6.18-238.21.1.el5.ia64.rpm
kernel-xen-2.6.18-238.21.1.el5.ia64.rpm
kernel-xen-debuginfo-2.6.18-238.21.1.el5.ia64.rpm
kernel-xen-devel-2.6.18-238.21.1.el5.ia64.rpm
noarch:
kernel-doc-2.6.18-238.21.1.el5.noarch.rpm
ppc:
kernel-2.6.18-238.21.1.el5.ppc64.rpm
kernel-debug-2.6.18-238.21.1.el5.ppc64.rpm
kernel-debug-debuginfo-2.6.18-238.21.1.el5.ppc64.rpm
kernel-debug-devel-2.6.18-238.21.1.el5.ppc64.rpm
kernel-debuginfo-2.6.18-238.21.1.el5.ppc64.rpm
kernel-debuginfo-common-2.6.18-238.21.1.el5.ppc64.rpm
kernel-devel-2.6.18-238.21.1.el5.ppc64.rpm
kernel-headers-2.6.18-238.21.1.el5.ppc.rpm
kernel-headers-2.6.18-238.21.1.el5.ppc64.rpm
kernel-kdump-2.6.18-238.21.1.el5.ppc64.rpm
kernel-kdump-debuginfo-2.6.18-238.21.1.el5.ppc64.rpm
kernel-kdump-devel-2.6.18-238.21.1.el5.ppc64.rpm
s390x:
kernel-2.6.18-238.21.1.el5.s390x.rpm
kernel-debug-2.6.18-238.21.1.el5.s390x.rpm
kernel-debug-debuginfo-2.6.18-238.21.1.el5.s390x.rpm
kernel-debug-devel-2.6.18-238.21.1.el5.s390x.rpm
kernel-debuginfo-2.6.18-238.21.1.el5.s390x.rpm
kernel-debuginfo-common-2.6.18-238.21.1.el5.s390x.rpm
kernel-devel-2.6.18-238.21.1.el5.s390x.rpm
kernel-headers-2.6.18-238.21.1.el5.s390x.rpm
kernel-kdump-2.6.18-238.21.1.el5.s390x.rpm
kernel-kdump-debuginfo-2.6.18-238.21.1.el5.s390x.rpm
kernel-kdump-devel-2.6.18-238.21.1.el5.s390x.rpm
x86_64:
kernel-2.6.18-238.21.1.el5.x86_64.rpm
kernel-debug-2.6.18-238.21.1.el5.x86_64.rpm
kernel-debug-debuginfo-2.6.18-238.21.1.el5.x86_64.rpm
kernel-debug-devel-2.6.18-238.21.1.el5.x86_64.rpm
kernel-debuginfo-2.6.18-238.21.1.el5.x86_64.rpm
kernel-debuginfo-common-2.6.18-238.21.1.el5.x86_64.rpm
kernel-devel-2.6.18-238.21.1.el5.x86_64.rpm
kernel-headers-2.6.18-238.21.1.el5.x86_64.rpm
kernel-xen-2.6.18-238.21.1.el5.x86_64.rpm
kernel-xen-debuginfo-2.6.18-238.21.1.el5.x86_64.rpm
kernel-xen-devel-2.6.18-238.21.1.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-1780.html
https://www.redhat.com/security/data/cve/CVE-2011-2525.html
https://access.redhat.com/security/updates/classification/#important
https://rhn.redhat.com/errata/RHSA-2011-1065.html
https://rhn.redhat.com/errata/RHSA-2009-1243.html
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: thunderbird security update
Advisory ID: RHSA-2011:1166-01
Product: Red Hat Enterprise Linux
Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-1166.html
Issue date: 2011-08-16
CVE Names: CVE-2011-0084 CVE-2011-2378 CVE-2011-2982
=====================================================================
1. Summary:
An updated thunderbird package that fixes several security issues is now
available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
3. Description:
Mozilla Thunderbird is a standalone mail and newsgroup client.
Several flaws were found in the processing of malformed HTML content.
Malicious HTML content could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running Thunderbird.
(CVE-2011-2982)
A dangling pointer flaw was found in the Thunderbird Scalable Vector
Graphics (SVG) text manipulation routine. An HTML mail message containing a
malicious SVG image could cause Thunderbird to crash or, potentially,
execute arbitrary code with the privileges of the user running Thunderbird.
(CVE-2011-0084)
A dangling pointer flaw was found in the way Thunderbird handled a certain
Document Object Model (DOM) element. An HTML mail message containing
malicious content could cause Thunderbird to crash or, potentially, execute
arbitrary code with the privileges of the user running Thunderbird.
(CVE-2011-2378)
All Thunderbird users should upgrade to this updated package, which
resolves these issues. All running instances of Thunderbird must be
restarted for the update to take effect.
4. Solution:
Before applying this update, make sure all previously-released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259
5. Bugs fixed (http://bugzilla.redhat.com/):
730518 - CVE-2011-2982 Mozilla: Miscellaneous memory safety hazards
730519 - CVE-2011-0084 Mozilla: Crash in SVGTextElement.getCharNumAtPosition()
730521 - CVE-2011-2378 Mozilla: Dangling pointer vulnerability in appendChild
6. Package List:
Red Hat Enterprise Linux Desktop (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/thunderbird-3.1.12-1.el6_1.src.rpm
i386:
thunderbird-3.1.12-1.el6_1.i686.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.i686.rpm
x86_64:
thunderbird-3.1.12-1.el6_1.x86_64.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.x86_64.rpm
Red Hat Enterprise Linux Server Optional (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/thunderbird-3.1.12-1.el6_1.src.rpm
i386:
thunderbird-3.1.12-1.el6_1.i686.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.i686.rpm
ppc64:
thunderbird-3.1.12-1.el6_1.ppc64.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.ppc64.rpm
s390x:
thunderbird-3.1.12-1.el6_1.s390x.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.s390x.rpm
x86_64:
thunderbird-3.1.12-1.el6_1.x86_64.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.x86_64.rpm
Red Hat Enterprise Linux Workstation (v. 6):
Source:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/thunderbird-3.1.12-1.el6_1.src.rpm
i386:
thunderbird-3.1.12-1.el6_1.i686.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.i686.rpm
x86_64:
thunderbird-3.1.12-1.el6_1.x86_64.rpm
thunderbird-debuginfo-3.1.12-1.el6_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/#package
7. References:
https://www.redhat.com/security/data/cve/CVE-2011-0084.html
https://www.redhat.com/security/data/cve/CVE-2011-2378.html
https://www.redhat.com/security/data/cve/CVE-2011-2982.html
https://access.redhat.com/security/updates/classification/#critical
8. Contact:
The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2011 Red Hat, Inc.
