Advisories

Mandriva Advisories

Package name mozilla Date April 25th, 2006 Advisory ID MDKSA-2006:076 Affected versions CS3.0 Synopsis Updated mozilla packages fix numerous vulnerabilities

Problem Description

A number of vulnerabilities have been discovered in the Mozilla Suite
that could allow a remote attacker to craft malicious web pages that
could take advantage of these issues to execute arbitrary code with
elevated privileges, spoof content, and steal local files, cookies, or
other information from web pages. As well, some of these
vulnerabilities can be exploited to execute arbitrary code with the
privileges of the user running the browser.

As well, two crasher bugs have been fixed as well.

The updated packages have been patched to fix these problems.

Updated Packages

Corporate Server 3.0

 81dce00119439ab171593eb2976fe547  corporate/3.0/RPMS/libnspr4-1.7.8-0.8.C30mdk.i586.rpm
 c0e04b64accc75483ca0795af33562be  corporate/3.0/RPMS/libnspr4-devel-1.7.8-0.8.C30mdk.i586.rpm
 288e4e8379aa0d7cc56327ba60035e0a  corporate/3.0/RPMS/libnss3-1.7.8-0.8.C30mdk.i586.rpm
 c1bac96a978df5d75cfd7887a09144d5  corporate/3.0/RPMS/libnss3-devel-1.7.8-0.8.C30mdk.i586.rpm
 0d06c6a4520068a368cf48e3f407c74e  corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.i586.rpm
 73f9e85c4556834db6ef9333b98beef0  corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.i586.rpm
 6939f71693b40125b5c3dd0534441d4a  corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.i586.rpm
 cb3df735d1ce023dd9cfeed26889c91b  corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.i586.rpm
 7aee6465cb0a42c6561b3c3deac96c8d  corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.i586.rpm
 01ec6255f2071d246ef76a11b2844c8e  corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.i586.rpm
 8d4075f4c1c9cd4f613a68ff15f09d85  corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.i586.rpm
 cc4bcc8c9c19557513ef30d96150b9fe  corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.i586.rpm
 05ab0503358b30c10dba88bb916473be  corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.i586.rpm
 ddccba24ecfaa9f82167a7bb5c9c71ad  corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm

Corporate Server 3.0/X86_64

 9a8e62df1100fa84600706050870a63e  x86_64/corporate/3.0/RPMS/lib64nspr4-1.7.8-0.8.C30mdk.x86_64.rpm
 17c9c8233a462fc91061554c0a0ef451  x86_64/corporate/3.0/RPMS/lib64nspr4-devel-1.7.8-0.8.C30mdk.x86_64.rpm
 efa25dec22975bab70c748d07e0a3c75  x86_64/corporate/3.0/RPMS/lib64nss3-1.7.8-0.8.C30mdk.x86_64.rpm
 38de0287eaf7ed9f2e319cbcc042dcdf  x86_64/corporate/3.0/RPMS/lib64nss3-devel-1.7.8-0.8.C30mdk.x86_64.rpm
 18393cfe8c07b958e52a6f0f2b506e53  x86_64/corporate/3.0/RPMS/mozilla-1.7.8-0.8.C30mdk.x86_64.rpm
 e6aea2fc34c466383781cb6487964cc0  x86_64/corporate/3.0/RPMS/mozilla-devel-1.7.8-0.8.C30mdk.x86_64.rpm
 be9a4c7519f064b07b48ea9556866f74  x86_64/corporate/3.0/RPMS/mozilla-dom-inspector-1.7.8-0.8.C30mdk.x86_64.rpm
 085cc65fea8f657875c5024c0d964a5d  x86_64/corporate/3.0/RPMS/mozilla-enigmail-1.7.8-0.8.C30mdk.x86_64.rpm
 1b6244b6bf96093518937ccf8dcd33c6  x86_64/corporate/3.0/RPMS/mozilla-enigmime-1.7.8-0.8.C30mdk.x86_64.rpm
 e66333a5573e85f32effe85a01a64a27  x86_64/corporate/3.0/RPMS/mozilla-irc-1.7.8-0.8.C30mdk.x86_64.rpm
 4bfb009ca3dcdc90ff1eb2f244cafdc4  x86_64/corporate/3.0/RPMS/mozilla-js-debugger-1.7.8-0.8.C30mdk.x86_64.rpm
 caddf105e2756d3bebf74ad2f4e8a0d6  x86_64/corporate/3.0/RPMS/mozilla-mail-1.7.8-0.8.C30mdk.x86_64.rpm
 f1551cc11e1e75be6d25cf2f53070ac0  x86_64/corporate/3.0/RPMS/mozilla-spellchecker-1.7.8-0.8.C30mdk.x86_64.rpm
 ddccba24ecfaa9f82167a7bb5c9c71ad  x86_64/corporate/3.0/SRPMS/mozilla-1.7.8-0.8.C30mdk.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0748
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0749
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1727
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1728
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1729
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1731
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1732
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1733
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1734
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1735
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1736
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1737
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1738
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1741
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1742
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1790
https://bugzilla.mozilla.org/show_bug.cgi?id=275896
https://bugzilla.mozilla.org/show_bug.cgi?id=330900

Upgrade

To upgrade automatically, use MandrivaUpdate.

Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm
                

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.