dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Advisories, June 19, 2006

Jun 20, 2006, 04:45 (0 Talkback[s])

Gentoo Linux Security Advisory GLSA 200606-20

http://security.gentoo.org/


Severity: High
Title: Typespeed: Remote execution of arbitrary code
Date: June 19, 2006
Bugs: #135071
ID: 200606-20


Synopsis

A buffer overflow in the network code of Typespeed can lead to the execution of arbitrary code.

Background

Typespeed is a game to test and practice 10-finger-typing. Network code allows two users to compete head-to-head.

Affected packages


     Package               /  Vulnerable  /                 Unaffected

  1  games-misc/typespeed       < 0.5.0                       >= 0.5.0

Description

Niko Tyni discovered a buffer overflow in the addnewword() function of Typespeed's network code.

Impact

By sending specially crafted network packets to a machine running Typespeed in multiplayer mode, a remote attacker can execute arbitrary code with the permissions of the user running the game.

Workaround

Do not run Typespeed in multiplayer mode. There is no known workaround at this time for multiplayer mode.

Resolution

All Typespeed users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=games-misc/typespeed-0.5.0"

References

[ 1 ] CVE-2006-1515

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1515

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-20.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


Gentoo Linux Security Advisory GLSA 200606-21

http://security.gentoo.org/


Severity: Normal
Title: Mozilla Thunderbird: Multiple vulnerabilities
Date: June 19, 2006
Bugs: #135256
ID: 200606-21


Synopsis

Several vulnerabilities in Mozilla Thunderbird allow cross site scripting, JavaScript privilege escalation and possibly execution of arbitrary code.

Background

Mozilla Thunderbird is the next-generation mail client from the Mozilla project.

Affected packages


     Package                  /  Vulnerable  /              Unaffected


1 mozilla-thunderbird < 1.5.0.4 >= 1.5.0.4 2 mozilla-thunderbird-bin < 1.5.0.4 >= 1.5.0.4 ------------------------------------------------------------------- 2 affected packages on all of their supported architectures.

Description

Several vulnerabilities were found and fixed in Mozilla Thunderbird. For details, please consult the references below.

Impact

A remote attacker could craft malicious emails that would leverage these issues to inject and execute arbitrary script code with elevated privileges, spoof content, and possibly execute arbitrary code with the rights of the user running the application.

Workaround

There are no known workarounds for all the issues at this time.

Resolution

All Mozilla Thunderbird users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/mozilla-thunderbird-1.5.0.4"

All Mozilla Thunderbird binary users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/mozilla-thunderbird-bin-1.5.0.4"

Note: There is no stable fixed version for the Alpha architecture yet. Users of Mozilla Thunderbird on Alpha should consider unmerging it until such a version is available.

References

[ 1 ] CVE-2006-2775

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775

[ 2 ] CVE-2006-2776

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776

[ 3 ] CVE-2006-2778

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778

[ 4 ] CVE-2006-2779

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779

[ 5 ] CVE-2006-2780

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2780

[ 6 ] CVE-2006-2781

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2781

[ 7 ] CVE-2006-2783

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2783

[ 8 ] CVE-2006-2786

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2786

[ 9 ] CVE-2006-2787

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2787

[ 10 ] Mozilla Foundation Security Advisories

http://www.mozilla.org/projects/security/known-vulnerabilities.html#Thunderbird

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200606-21.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2006 Gentoo Foundation, Inc; referenced text belongs to its owner(s).

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5