ID de Prueba:	1.3.6.1.4.1.25623.1.0.831346
Categoría:	Mandrake Local Security Checks
Título:	Mandriva Update for mozilla-thunderbird MDVSA-2011:042 (mozilla-thunderbird)
Resumen:	The remote host is missing an update for the 'mozilla-thunderbird'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'mozilla-thunderbird' package(s) announced via the referenced advisory. Vulnerability Insight: Security issues were identified and fixed in mozilla-thunderbird: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-0053). Buffer overflow in Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JPEG image (CVE-2011-0061). Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2011-0062). The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not properly sanitize HTML in a chrome document, which makes it easier for remote attackers to execute arbitrary JavaScript with chrome privileges via a javascript: URI in input to an extension, as demonstrated by a javascript:alert sequence in (1) the HREF attribute of an A element or (2) the ACTION attribute of a FORM element (CVE-2010-1585). Packages for 2009.0 are provided as of the Extended Maintenance Program. Additionally, some packages which require so, have been rebuilt and are being provided as updates. Affected Software/OS: mozilla-thunderbird on Mandriva Linux 2009.0, Mandriva Linux 2009.0/X86_64, Mandriva Linux 2010.0, Mandriva Linux 2010.0/X86_64, Mandriva Linux 2010.1, Mandriva Linux 2010.1/X86_64 Solution: Please Install the Updated Packages. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-0053 BugTraq ID: 46645 http://www.securityfocus.com/bid/46645 http://www.mandriva.com/security/advisories?name=MDVSA-2011:042 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14379 http://www.redhat.com/support/errata/RHSA-2011-0312.html http://www.redhat.com/support/errata/RHSA-2011-0313.html Common Vulnerability Exposure (CVE) ID: CVE-2011-0061 BugTraq ID: 46651 http://www.securityfocus.com/bid/46651 http://www.mandriva.com/security/advisories?name=MDVSA-2011:041 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14486 Common Vulnerability Exposure (CVE) ID: CVE-2011-0062 BugTraq ID: 46647 http://www.securityfocus.com/bid/46647 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14409 Common Vulnerability Exposure (CVE) ID: CVE-2010-1585 Bugtraq: 20100421 Security-Assessment.com WhitePaper/Addendum: Cross Context Scripting with Firefox & Exploiting Cross Context Scripting vulnerabilities in Firefox (Google Search) http://www.securityfocus.com/archive/1/510883/100/0/threaded http://wizzrss.blat.co.za/2009/11/17/so-much-for-nsiscriptableunescapehtmlparsefragment/ http://www.security-assessment.com/files/whitepapers/Cross_Context_Scripting_with_Firefox.pdf https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12532
Copyright	Copyright (C) 2011 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.