355 lines
20 KiB
JSON
355 lines
20 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20131057",
|
|
"Version": "oval:org.altlinux.errata:def:20131057",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2013-1057: package `thunderbird` update to version 24.1.0-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2013-1057",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2013-1057",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00443",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00443",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00447",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00447",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00467",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00467",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00470",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00470",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00706",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00706",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2015-00714",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2015-00714",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5590",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5590",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5591",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5591",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5593",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5593",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5595",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5595",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5596",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5596",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5597",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5597",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5599",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5599",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5600",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5600",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5601",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5601",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5602",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5602",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5603",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5603",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2013-5604",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2013-5604",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-1562",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-1562",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2014-1567",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-1567",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades thunderbird to version 24.1.0-alt1. \nSecurity Fix(es):\n\n * BDU:2015-00443: Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00447: Уязвимость браузера Firefox, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00467: Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00470: Уязвимость программного обеспечения Firefox ESR, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00706: Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2015-00714: Уязвимость программного обеспечения Thunderbird, позволяющая удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации\n\n * CVE-2013-5590: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.\n\n * CVE-2013-5591: Unspecified vulnerability in the browser engine in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.\n\n * CVE-2013-5593: The SELECT element implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly restrict the nature or placement of HTML within a dropdown menu, which allows remote attackers to spoof the address bar or conduct clickjacking attacks via vectors that trigger navigation off of a page containing this element.\n\n * CVE-2013-5595: The JavaScript engine in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly allocate memory for unspecified functions, which allows remote attackers to conduct buffer overflow attacks via a crafted web page.\n\n * CVE-2013-5596: The cycle collection (CC) implementation in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 does not properly determine the thread for release of an image object, which allows remote attackers to execute arbitrary code or cause a denial of service (race condition and application crash) via a large HTML document containing IMG elements, as demonstrated by the Never-Ending Reddit on reddit.com.\n\n * CVE-2013-5597: Use-after-free vulnerability in the nsDocLoader::doStopDocumentLoad function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a state-change event during an update of the offline cache.\n\n * CVE-2013-5599: Use-after-free vulnerability in the nsIPresShell::GetPresContext function in the PresShell (aka presentation shell) implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a CANVAS element, a mozTextStyle attribute, and an onresize event.\n\n * CVE-2013-5600: Use-after-free vulnerability in the nsIOService::NewChannelFromURIWithProxyFlags function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors involving a blob: URL.\n\n * CVE-2013-5601: Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through the garbage collection (GC) API.\n\n * CVE-2013-5602: The Worker::SetEventListener function in the Web workers implementation in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to direct proxies.\n\n * CVE-2013-5603: Use-after-free vulnerability in the nsContentUtils::ContentIsHostIncludingDescendantOf function in Mozilla Firefox before 25.0, Firefox ESR 24.x before 24.1, Thunderbird before 24.1, and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving HTML document templates.\n\n * CVE-2013-5604: The txXPathNodeUtils::getBaseURI function in the XSLT processor in Mozilla Firefox before 25.0, Firefox ESR 17.x before 17.0.10 and 24.x before 24.1, Thunderbird before 24.1, Thunderbird ESR 17.x before 17.0.10, and SeaMonkey before 2.22 does not properly initialize data, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via crafted documents.\n\n * CVE-2014-1562: Unspecified vulnerability in the browser engine in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.\n\n * CVE-2014-1567: Use-after-free vulnerability in DirectionalityUtils.cpp in Mozilla Firefox before 32.0, Firefox ESR 24.x before 24.8 and 31.x before 31.1, and Thunderbird 24.x before 24.8 and 31.x before 31.1 allows remote attackers to execute arbitrary code via text that is improperly handled during the interaction between directionality resolution and layout.\n\n * MFSA 2013-10: description unavailable\n\n * MFSA 2013-93: description unavailable\n\n * MFSA 2013-94: description unavailable\n\n * MFSA 2013-95: description unavailable\n\n * MFSA 2013-96: description unavailable\n\n * MFSA 2013-97: description unavailable\n\n * MFSA 2013-98: description unavailable",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "Critical",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2013-11-06"
|
|
},
|
|
"Updated": {
|
|
"Date": "2013-11-06"
|
|
},
|
|
"BDUs": [
|
|
{
|
|
"ID": "BDU:2015-00443",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-416",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00443",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00447",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00447",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00467",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00467",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00470",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00470",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00706",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00706",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "BDU:2015-00714",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"Href": "https://bdu.fstec.ru/vul/2015-00714",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
}
|
|
],
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2013-5590",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5590",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5591",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-noinfo",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5591",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5593",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5593",
|
|
"Impact": "Low",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5595",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5595",
|
|
"Impact": "Low",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5596",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5596",
|
|
"Impact": "Low",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5597",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5597",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5599",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5599",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5600",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5600",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5601",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5601",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5602",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5602",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5603",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5603",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2013-5604",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2013-5604",
|
|
"Impact": "Critical",
|
|
"Public": "20131030"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-1562",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
|
"CWE": "CWE-119",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-1562",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
},
|
|
{
|
|
"ID": "CVE-2014-1567",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
|
"CWE": "NVD-CWE-Other",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-1567",
|
|
"Impact": "Critical",
|
|
"Public": "20140903"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057001",
|
|
"Comment": "rpm-build-thunderbird is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057002",
|
|
"Comment": "thunderbird is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057003",
|
|
"Comment": "thunderbird-calendar-timezones is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057004",
|
|
"Comment": "thunderbird-devel is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057005",
|
|
"Comment": "thunderbird-enigmail is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057006",
|
|
"Comment": "thunderbird-google-calendar is earlier than 0:24.1.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20131057007",
|
|
"Comment": "thunderbird-lightning is earlier than 0:24.1.0-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |