Debian Security Advisory

DSA-2528-1 icedove -- several vulnerabilities

Date Reported:
14 Aug 2012
Affected Packages:
icedove
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2012-1948, CVE-2012-1950, CVE-2012-1954, CVE-2012-1967.
More information:

Several vulnerabilities were discovered in Icedove, Debian's version of the Mozilla Thunderbird mail and news client.

  • CVE-2012-1948

    Multiple unspecified vulnerabilities in the browser engine were fixed.

  • CVE-2012-1950

    The underlying browser engine allows address bar spoofing through drag-and-drop.

  • CVE-2012-1954

    A use-after-free vulnerability in the nsDocument::AdoptNode function allows remote attackers to cause a denial of service (heap memory corruption) or possibly execute arbitrary code.

  • CVE-2012-1967

    An error in the implementation of the JavaScript sandbox allows execution of JavaScript code with improper privileges using javascript: URLs.

For the stable distribution (squeeze), these problems have been fixed in version 3.0.11-1+squeeze12.

For the testing distribution (wheezy) and the unstable distribution (sid), these problems have been fixed in version 10.0.6-1.

We recommend that you upgrade your icedove packages.