Home / mailings [SECURITY] [DSA 2406-1] icedove security update
Posted on 09 February 2012
Debian Security Advisory-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- -------------------------------------------------------------------------
Debian Security Advisory DSA-2406-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
February 09, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : icedove
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3670 CVE-2012-0442 CVE-2012-0444 CVE-2012-0449
Several vulnerabilities have been discovered in Icedove, Debian's
variant of the Mozilla Thunderbird code base.
CVE-2011-3670
Icedove does not not properly enforce the IPv6 literal address
syntax, which allows remote attackers to obtain sensitive
information by making XMLHttpRequest calls through a proxy and
reading the error messages.
CVE-2012-0442
Memory corruption bugs could cause Icedove to crash or
possibly execute arbitrary code.
CVE-2012-0444
Icedove does not properly initialize nsChildView data
structures, which allows remote attackers to cause a denial of
service (memory corruption and application crash) or possibly
execute arbitrary code via a crafted Ogg Vorbis file.
CVE-2012-0449
Icedove allows remote attackers to cause a denial of service
(memory corruption and application crash) or possibly execute
arbitrary code via a malformed XSLT stylesheet that is
embedded in a document
For the stable distribution (squeeze), this problem has been fixed in
version 3.0.11-1+squeeze7.
We recommend that you upgrade your icedove packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
