Bug 193906

Summary:	CVE-2006-2779 Multiple Mozilla issues (CVE-2006-2780, CVE-2006-2781)
Product:	Red Hat Enterprise Linux 4	Reporter:	Josh Bressers <bressers>
Component:	mozilla	Assignee:	Christopher Aillon <caillon>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	4.0	CC:	deisenst
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=critical,source=mozilla,reported=20060601,public=20060602
Fixed In Version:	RHSA-2006-0609	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2006-08-02 18:31:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	194440

Description Josh Bressers 2006-06-02 20:20:42 UTC

Text stolen from MITRE:

CVE-2006-2781
Double-free vulnerability in Mozilla Thunderbird before 1.5.0.4 and
SeaMonkey before 1.0.2 allows remote attackers to cause a denial of
service (hang) and possibly execute arbitrary code via a VCard that
contains invalid base64 characters.

CVE-2006-2779
Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers
to cause a denial of service (crash) and possibly execute arbitrary
code via (1) nested <option> tags in a select tag, (2) a
DOMNodeRemoved mutation event, (3) "Content-implemented tree views,"
(4) BoxObjects, (5) the XBL implementation, (6) an iframe that
attempts to remove itself, which leads to memory corruption.

Comment 1 Josh Bressers 2006-06-02 20:22:42 UTC

These issues also affect RHEL2.1 and RHEL3

Comment 4 Josh Bressers 2006-07-12 14:54:23 UTC

CVE-2006-2780
Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote
attackers to cause a denial of service (crash) and possibly execute arbitrary
code via "jsstr tagify," which leads to memory corruption.

Comment 8 Red Hat Bugzilla 2006-08-02 18:31:06 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0609.html