__________________________________________________________
The U.S. Department of Energy
Computer Incident Advisory Capability
___ __ __ _ ___
/ | /_\ /
\___ __|__ / \ \___
__________________________________________________________
INFORMATION BULLETIN
Seamonkey Security Update
[RHSA-2006:0608-6]
July 28, 2006 17:00 GMT Number Q-259
[REVISED 01 Aug 2006]
[REVISED 03 Aug 2006]
[REVISED 28 Aug 2006]
[REVISED 29 Aug 2006]
[REVISED 30 Aug 2006]
[REVISED 08 Sept 2006]
[REVISED 14 Sept 2006]
[REVISED 15 Sept 2006]
[REVISED 2 Apr 2007]
[REVISED 27 Jun 2007]
______________________________________________________________________________
PROBLEM: Several flaws were found in the way SeaMonkey processed certain
javascript actions. Several denial of service flaws were found
in the way SeaMonkey processed certain web content. A buffer
overflow flaw was found in the way SeaMonkey Messenger
displayed malformed inline vcard attachments. Several flaws
were found in the way SeaMonkey processed certain javascript
actions. A flaw was found in the way SeaMonkey processed Proxy
AutoConfig scripts.
PLATFORM: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
Solaris 8, 9, 10 Operating System
DAMAGE: A malicious web page could execute arbitrary javascript
instructions with the permissions of "chrome", allowing the
page to steal sensitive information or install browser malware.
A malicious web page could crash the browser or possibly
execute arbitrary code as the user running SeaMonkey. If a
victim viewed an email message containing a carefully crafted
vcard, it was possible to execute arbitrary code as the user
running SeaMonkey Messenger. A malicious web page could conduct
a cross-site scripting attack or steal sensitive information
(such as cookies owned by other domains). A malicious Proxy
AutoConfig server could execute arbitrary javascript
instructions with the permissions of "chrome", allowing the
page to steal sensitive information or install browser malware.
SOLUTION: Apply current patches.
______________________________________________________________________________
VULNERABILITY The risk is HIGH. The worst of these could allow a remote
ASSESSMENT: attacker to execute arbitrary code.
______________________________________________________________________________
LINKS:
CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/q-259.shtml
ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2006-0608.html
ADDITIONAL LINKS: Red Hat Security Advisory-2006:0611-3
https://rhn.redhat.com/errata/RHSA-2006-0611.html
Red Hat Security Advisory-2006:0610-4
https://rhn.redhat.com/errata/RHSA-2006-0610.html
Red Hat Security Advisory 2006:0609-9
https://rhn.redhat.com/errata/RHSA-2006-0609.html
Debian Security Advisory 1159-2
http://www.debian.org/security/2006/dsa-1159
RHSA-2006:0594-9
https://rhn.redhat.com/errata/RHSA-2006-0594.html
Debian Security Advisory 1160-2
http://www.debian.org/security/2006/dsa-1160
Debian Security Advisory 1161-2
http://www.debian.org/security/2006/dsa-1161
Sun Alert ID: 102865
http://www.sunsolve.sun.com/search/document.do?assetkey
=1-26-102865-1
Sun Alert ID: 102971
http://www.sunsolve.sun.com/search/document.do?assetkey
=1-26-102971-1
CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=
CVE-2006-3113 CVE-2006-3677 CVE-2006-3801 CVE-2006-3802
CVE-2006-3803 CVE-2006-3804 CVE-2006-3805 CVE-2006-3806
CVE-2006-3807 CVE-2006-3808 CVE-2006-3809 CVE-2006-3810
CVE-2006-3811 CVE-2006-3812
______________________________________________________________________________
REVISION HISTORY:
08/01/2006 - revised to add links to Red Hat Security Advisory-2006:0611-3 and Red Hat Security Advisory-2006:0610-4
08/03/2006 - added a link to Red Hat Security Advisory 2006:0609-9
08/28/2006 - added links to Debian Security Advisory 1159-1 and RHSA-2006:0594-9
08/29/2006 - added links to Debian Security Advisory 1160-1
08/30/2006 - added links to Debian Security Advisory 1161-1
09/08/2006 - modified link to Debian Security Advisory DSA-1159-2
09/14/2006 - updated to note that Debian Security Advisory 1161-2 states the latest security updates of Mozilla Firefox introduced a
regression that led to a disfunctional attachment panel which warrants a correction to fix this issue
09/15/2006 - updated to note that Debian Security Advisory 1160-2 states the latest security updates of Mozilla introduced a
regression that led to a disfunctional attachment panel which warrants a correction to fix this issue
04/02/2007 - revised Q-259 to add a link to Sun Alert ID: 102865 for Solaris 8, 9,
and 10 Operating System.
06/27/2007 - revised Q-259 to add a link to Sun Alert ID: 102971 for Solaris 8, 9,
and 10 Operating System.
[***** Start RHSA-2006:0608-6 *****]
Critical: seamonkey security update
Advisory: RHSA-2006:0608-6
Type: Security Advisory
Issued on: 2006-07-27
Last updated on: 2006-07-27
Affected Products: Red Hat Desktop (v. 3)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux WS (v. 3)
CVEs (cve.mitre.org): CVE-2006-3113
CVE-2006-3677
CVE-2006-3801
CVE-2006-3802
CVE-2006-3803
CVE-2006-3804
CVE-2006-3805
CVE-2006-3806
CVE-2006-3807
CVE-2006-3808
CVE-2006-3809
CVE-2006-3810
CVE-2006-3811
CVE-2006-3812
Details
Updated seamonkey packages that fix several security bugs are now available
for Red Hat Enterprise Linux 3.
This update has been rated as having critical security impact by the Red
Hat Security Response Team.
SeaMonkey is an open source Web browser, advanced email and newsgroup
client, IRC chat client, and HTML editor.
Several flaws were found in the way SeaMonkey processed certain javascript
actions. A malicious web page could execute arbitrary javascript
instructions with the permissions of "chrome", allowing the page to steal
sensitive information or install browser malware. (CVE-2006-3807,
CVE-2006-3809, CVE-2006-3812)
Several denial of service flaws were found in the way SeaMonkey processed
certain web content. A malicious web page could crash the browser or
possibly execute arbitrary code as the user running SeaMonkey.
(CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805,
CVE-2006-3806, CVE-2006-3811)
A buffer overflow flaw was found in the way SeaMonkey Messenger displayed
malformed inline vcard attachments. If a victim viewed an email message
containing a carefully crafted vcard, it was possible to execute arbitrary
code as the user running SeaMonkey Messenger. (CVE-2006-3804)
Several flaws were found in the way SeaMonkey processed certain javascript
actions. A malicious web page could conduct a cross-site scripting attack
or steal sensitive information (such as cookies owned by other domains).
(CVE-2006-3802, CVE-2006-3810)
A flaw was found in the way SeaMonkey processed Proxy AutoConfig scripts. A
malicious Proxy AutoConfig server could execute arbitrary javascript
instructions with the permissions of "chrome", allowing the page to steal
sensitive information or install browser malware. (CVE-2006-3808)
Users of SeaMonkey are advised to upgrade to this update, which contains
SeaMonkey version 1.0.3 that corrects these issues.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
Updated packages
Red Hat Desktop (v. 3)
SRPMS:
seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c
IA-32:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282
seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9
seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e
seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87
seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a
x86_64:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91
seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11
seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c
seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37
seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e
seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659
seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845
seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f
Red Hat Enterprise Linux AS (v. 3)
SRPMS:
seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c
IA-32:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282
seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9
seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e
seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87
seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a
IA-64:
seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830
seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084
seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2
seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72
seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8
seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a
seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e
seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98
PPC:
seamonkey-1.0.3-0.el3.1.ppc.rpm 3557460aa7a520cf3ae737e97a23cabf
seamonkey-chat-1.0.3-0.el3.1.ppc.rpm 5da4d6c953c2375ea944da5bbc6d65d7
seamonkey-devel-1.0.3-0.el3.1.ppc.rpm 4a13b4766810a93c338c6e61eb7c2878
seamonkey-dom-inspector-1.0.3-0.el3.1.ppc.rpm 43af0613aef928839f9953be9275976e
seamonkey-js-debugger-1.0.3-0.el3.1.ppc.rpm 47c3640748bb8028f99fdc8df7143726
seamonkey-mail-1.0.3-0.el3.1.ppc.rpm 8b0ac20bf0eb1665c48503c1e0be2190
seamonkey-nspr-1.0.3-0.el3.1.ppc.rpm 81048df18d14782470b2191138ca1d1d
seamonkey-nspr-devel-1.0.3-0.el3.1.ppc.rpm b086f5ca564b9dc92f7cb42d05cfe152
seamonkey-nss-1.0.3-0.el3.1.ppc.rpm 9bfb86324ed33e65b75a222e4f4d594c
seamonkey-nss-devel-1.0.3-0.el3.1.ppc.rpm 8ead6a1dbcf7127d1be215be9386315f
s390:
seamonkey-1.0.3-0.el3.1.s390.rpm 484c596e85d071c16b60a4ff7b588cb2
seamonkey-chat-1.0.3-0.el3.1.s390.rpm 1d19478fe278e8810d37d0e53b843bdd
seamonkey-devel-1.0.3-0.el3.1.s390.rpm 1cdd722aaf5be9fde448c5f6572af567
seamonkey-dom-inspector-1.0.3-0.el3.1.s390.rpm 1271e3bd7a31e1a61ed06ea92700316b
seamonkey-js-debugger-1.0.3-0.el3.1.s390.rpm c48f29a1788d2724a0242b9905f4257f
seamonkey-mail-1.0.3-0.el3.1.s390.rpm 2cdab0ae5eac44b1ce498dd30b7bbc37
seamonkey-nspr-1.0.3-0.el3.1.s390.rpm b846008adfbdad2b17be5016674c7bae
seamonkey-nspr-devel-1.0.3-0.el3.1.s390.rpm bd9ddc4a63442bca42902f1ba24f36af
seamonkey-nss-1.0.3-0.el3.1.s390.rpm bcb5e6d4273210272de5885cd4493df5
seamonkey-nss-devel-1.0.3-0.el3.1.s390.rpm 4931ae4f6b847dc3e9ad4e6a7cbff616
s390x:
seamonkey-1.0.3-0.el3.1.s390x.rpm d575784f960eae10569f23e9b960539f
seamonkey-chat-1.0.3-0.el3.1.s390x.rpm 13515109a27470d1473382feed63ac85
seamonkey-devel-1.0.3-0.el3.1.s390x.rpm dca79815a7bf6b1abc31c3d1da3f8b7d
seamonkey-dom-inspector-1.0.3-0.el3.1.s390x.rpm 69658420caf319c4a87f9d08cb1f8b63
seamonkey-js-debugger-1.0.3-0.el3.1.s390x.rpm b3084333c4285c43b1e7f98d121459d4
seamonkey-mail-1.0.3-0.el3.1.s390x.rpm b1c98f83174a4294e6442fd85cc54c1e
seamonkey-nspr-1.0.3-0.el3.1.s390.rpm b846008adfbdad2b17be5016674c7bae
seamonkey-nspr-1.0.3-0.el3.1.s390x.rpm 94825bce286f505d30157ed388ec0851
seamonkey-nspr-devel-1.0.3-0.el3.1.s390x.rpm bd5db4932cf91db2e1ab44543bf88b24
seamonkey-nss-1.0.3-0.el3.1.s390.rpm bcb5e6d4273210272de5885cd4493df5
seamonkey-nss-1.0.3-0.el3.1.s390x.rpm bd25f904c8651f3339c6fb4110209673
seamonkey-nss-devel-1.0.3-0.el3.1.s390x.rpm 0317b5cc38abe9e5d753407e6053724f
x86_64:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91
seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11
seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c
seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37
seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e
seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659
seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845
seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f
Red Hat Enterprise Linux ES (v. 3)
SRPMS:
seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c
IA-32:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282
seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9
seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e
seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87
seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a
IA-64:
seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830
seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084
seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2
seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72
seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8
seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a
seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e
seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98
x86_64:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91
seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11
seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c
seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37
seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e
seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659
seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845
seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f
Red Hat Enterprise Linux WS (v. 3)
SRPMS:
seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c
IA-32:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282
seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9
seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e
seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87
seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a
IA-64:
seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830
seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084
seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2
seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72
seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8
seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a
seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e
seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98
x86_64:
seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712
seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91
seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11
seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c
seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37
seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e
seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a
seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5
seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659
seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee
seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee
seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845
seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f
(The unlinked packages above are only available from the Red Hat Network)
Bugs fixed (see bugzilla for more information)
200253 - CVE-2006-3801 Multiple Seamonkey issues (CVE-2006-3677, CVE-2006-3113, CVE-2006-3802, CVE-2006-3803, CVE-2006-3804,
CVE-2006-3805, CVE-2006-3806, CVE-2006-3807, CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811, CVE-2006-3812)
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812
http://www.redhat.com/security/updates/classification/#critical
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package
The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/
[***** End RHSA-2006:0608-6 *****]
_______________________________________________________________________________
CIAC wishes to acknowledge the contributions of Red Hat for the
information contained in this bulletin.
_______________________________________________________________________________
CIAC, the Computer Incident Advisory Capability, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.
CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
Voice: +1 925-422-8193 (7x24)
FAX: +1 925-423-8002
STU-III: +1 925-423-2604
E-mail: ciac@ciac.org
Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.
World Wide Web: http://www.ciac.org/
Anonymous FTP: ftp.ciac.org
PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins. If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.
This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.
LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)
Q-249: Vulnerability in PowerPoint
Q-250: Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS)
Q-251: Oracle Critical Patch Update - July 2006
Q-252: libwmf Security Update
Q-253: gimp Security Update
Q-254: SeaMonkey Security Update (was Mozilla)
Q-255: OpenSSH Security Update
Q-256: Adobe Acrobat Buffer Overflow Vulnerability
Q-257: PHP Security Update
Q-258: Mozilla (now SeaMonkey), Firefox, Thunderbird Security Vulnerabilities