Bug 183550

Summary:	CVE-2006-0749 Thunderbird Tag Order Vulnerability
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	thunderbird	Assignee:	Christopher Aillon <caillon>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	medium
Version:	4.0	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	source=mozilla,reported=20051213,public=20060414,impact=critical
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-02-11 09:22:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2006-03-01 21:43:02 UTC

+++ This bug was initially created as a clone of Bug #183537 +++

There exists a remotely exploitable code execution vulnerability in Thunderbird
related to the order tags appear in an HTML document.  It is possible
for a malicious web page to execute arbitrary code as the user running Thunderbird.


-- Additional comment from bressers on 2006-03-01 16:01 EST --
Created an attachment (id=125496)
Proposed upstream patch

This patch should apply to aviary 1.0.7 and mozilla 1.7.12

Comment 1 Josh Bressers 2006-04-24 12:31:27 UTC

Lifting embargo

Comment 2 Matěj Cepl 2008-02-08 20:43:07 UTC

Since this bugzilla report was filed, we have seriously upgraded Gecko-related
packages, which may have resolved this issue. Users who have experienced this
problem are encouraged to upgrade their system to the latest version of their
distribution available.

Please, confirm to us that this bug is reproducible on the latest upgrade of the
supported distribution (that's RHEL, or Fedora 7, 8, and Rawhide).

Setting the bug to NEEDINFO. If I won't get confirmation of reproducability in
30 days, the bug will be closed as INSUFFICIENT_DATA.

[This is mass-changing of bugs which seem to be too old and irrelevant anymore;
we are sorry, if this bug should not be incldued.]

Comment 3 Tomas Hoger 2008-02-11 09:22:52 UTC

Updates pushed as:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2006-0328.html (firefox)
  http://rhn.redhat.com/errata/RHSA-2006-0329.html (mozilla)
  http://rhn.redhat.com/errata/RHSA-2006-0330.html (thunderbird)