Synopsis:	Moderate: thunderbird security update

Issue date:	2009-01-07

CVE Names:	CVE-2008-5500 CVE-2008-5501 CVE-2008-5502

                   CVE-2008-5503 CVE-2008-5506 CVE-2008-5507

                   CVE-2008-5508 CVE-2008-5511 CVE-2008-5512

                   CVE-2008-5513





Several flaws were found in the processing of malformed HTML mail content.

An HTML mail message containing malicious content could cause Thunderbird

to crash or, potentially, execute arbitrary code as the user running

Thunderbird. (CVE-2008-5500, CVE-2008-5501, CVE-2008-5502, CVE-2008-5511,

CVE-2008-5512, CVE-2008-5513)



Several flaws were found in the way malformed content was processed. An

HTML mail message containing specially-crafted content could potentially

trick a Thunderbird user into surrendering sensitive information.

(CVE-2008-5503, CVE-2008-5506, CVE-2008-5507)



Note: JavaScript support is disabled by default in Thunderbird; the above

issues are not exploitable unless JavaScript is enabled.



A flaw was found in the way malformed URLs were processed by

Thunderbird. This flaw could prevent various URL sanitization mechanisms

from properly parsing a malicious URL. (CVE-2008-5508)



All running instances of Thunderbird must be restarted for the update to take 

effect.



SL 4.x



     SRPMS:

thunderbird-1.5.0.12-18.el4.src.rpm

     i386:

thunderbird-1.5.0.12-18.el4.i386.rpm

     x86_64:

thunderbird-1.5.0.12-18.el4.x86_64.rpm



SL 5.x



     SRPMS:

thunderbird-2.0.0.19-1.el5_2.src.rpm

     i386:

thunderbird-2.0.0.19-1.el5_2.i386.rpm

     x86_64:

thunderbird-2.0.0.19-1.el5_2.x86_64.rpm



-Connie Sieh

-Troy Dawson