__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Seamonkey Security Update [RHSA-2006:0608-6] July 28, 2006 17:00 GMT Number Q-259 [REVISED 01 Aug 2006] [REVISED 03 Aug 2006] [REVISED 28 Aug 2006] [REVISED 29 Aug 2006] [REVISED 30 Aug 2006] [REVISED 08 Sept 2006] [REVISED 14 Sept 2006] [REVISED 15 Sept 2006] [REVISED 2 Apr 2007] [REVISED 27 Jun 2007] ______________________________________________________________________________ PROBLEM: Several flaws were found in the way SeaMonkey processed certain javascript actions. Several denial of service flaws were found in the way SeaMonkey processed certain web content. A buffer overflow flaw was found in the way SeaMonkey Messenger displayed malformed inline vcard attachments. Several flaws were found in the way SeaMonkey processed certain javascript actions. A flaw was found in the way SeaMonkey processed Proxy AutoConfig scripts. PLATFORM: Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) Solaris 8, 9, 10 Operating System DAMAGE: A malicious web page could execute arbitrary javascript instructions with the permissions of "chrome", allowing the page to steal sensitive information or install browser malware. A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey. If a victim viewed an email message containing a carefully crafted vcard, it was possible to execute arbitrary code as the user running SeaMonkey Messenger. A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). A malicious Proxy AutoConfig server could execute arbitrary javascript instructions with the permissions of "chrome", allowing the page to steal sensitive information or install browser malware. SOLUTION: Apply current patches. ______________________________________________________________________________ VULNERABILITY The risk is HIGH. The worst of these could allow a remote ASSESSMENT: attacker to execute arbitrary code. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/q-259.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2006-0608.html ADDITIONAL LINKS: Red Hat Security Advisory-2006:0611-3 https://rhn.redhat.com/errata/RHSA-2006-0611.html Red Hat Security Advisory-2006:0610-4 https://rhn.redhat.com/errata/RHSA-2006-0610.html Red Hat Security Advisory 2006:0609-9 https://rhn.redhat.com/errata/RHSA-2006-0609.html Debian Security Advisory 1159-2 http://www.debian.org/security/2006/dsa-1159 RHSA-2006:0594-9 https://rhn.redhat.com/errata/RHSA-2006-0594.html Debian Security Advisory 1160-2 http://www.debian.org/security/2006/dsa-1160 Debian Security Advisory 1161-2 http://www.debian.org/security/2006/dsa-1161 Sun Alert ID: 102865 http://www.sunsolve.sun.com/search/document.do?assetkey =1-26-102865-1 Sun Alert ID: 102971 http://www.sunsolve.sun.com/search/document.do?assetkey =1-26-102971-1 CVE: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2006-3113 CVE-2006-3677 CVE-2006-3801 CVE-2006-3802 CVE-2006-3803 CVE-2006-3804 CVE-2006-3805 CVE-2006-3806 CVE-2006-3807 CVE-2006-3808 CVE-2006-3809 CVE-2006-3810 CVE-2006-3811 CVE-2006-3812 ______________________________________________________________________________ REVISION HISTORY: 08/01/2006 - revised to add links to Red Hat Security Advisory-2006:0611-3 and Red Hat Security Advisory-2006:0610-4 08/03/2006 - added a link to Red Hat Security Advisory 2006:0609-9 08/28/2006 - added links to Debian Security Advisory 1159-1 and RHSA-2006:0594-9 08/29/2006 - added links to Debian Security Advisory 1160-1 08/30/2006 - added links to Debian Security Advisory 1161-1 09/08/2006 - modified link to Debian Security Advisory DSA-1159-2 09/14/2006 - updated to note that Debian Security Advisory 1161-2 states the latest security updates of Mozilla Firefox introduced a regression that led to a disfunctional attachment panel which warrants a correction to fix this issue 09/15/2006 - updated to note that Debian Security Advisory 1160-2 states the latest security updates of Mozilla introduced a regression that led to a disfunctional attachment panel which warrants a correction to fix this issue 04/02/2007 - revised Q-259 to add a link to Sun Alert ID: 102865 for Solaris 8, 9, and 10 Operating System. 06/27/2007 - revised Q-259 to add a link to Sun Alert ID: 102971 for Solaris 8, 9, and 10 Operating System. [***** Start RHSA-2006:0608-6 *****] Critical: seamonkey security update Advisory: RHSA-2006:0608-6 Type: Security Advisory Issued on: 2006-07-27 Last updated on: 2006-07-27 Affected Products: Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) CVEs (cve.mitre.org): CVE-2006-3113 CVE-2006-3677 CVE-2006-3801 CVE-2006-3802 CVE-2006-3803 CVE-2006-3804 CVE-2006-3805 CVE-2006-3806 CVE-2006-3807 CVE-2006-3808 CVE-2006-3809 CVE-2006-3810 CVE-2006-3811 CVE-2006-3812 Details Updated seamonkey packages that fix several security bugs are now available for Red Hat Enterprise Linux 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor. Several flaws were found in the way SeaMonkey processed certain javascript actions. A malicious web page could execute arbitrary javascript instructions with the permissions of "chrome", allowing the page to steal sensitive information or install browser malware. (CVE-2006-3807, CVE-2006-3809, CVE-2006-3812) Several denial of service flaws were found in the way SeaMonkey processed certain web content. A malicious web page could crash the browser or possibly execute arbitrary code as the user running SeaMonkey. (CVE-2006-3801, CVE-2006-3677, CVE-2006-3113, CVE-2006-3803, CVE-2006-3805, CVE-2006-3806, CVE-2006-3811) A buffer overflow flaw was found in the way SeaMonkey Messenger displayed malformed inline vcard attachments. If a victim viewed an email message containing a carefully crafted vcard, it was possible to execute arbitrary code as the user running SeaMonkey Messenger. (CVE-2006-3804) Several flaws were found in the way SeaMonkey processed certain javascript actions. A malicious web page could conduct a cross-site scripting attack or steal sensitive information (such as cookies owned by other domains). (CVE-2006-3802, CVE-2006-3810) A flaw was found in the way SeaMonkey processed Proxy AutoConfig scripts. A malicious Proxy AutoConfig server could execute arbitrary javascript instructions with the permissions of "chrome", allowing the page to steal sensitive information or install browser malware. (CVE-2006-3808) Users of SeaMonkey are advised to upgrade to this update, which contains SeaMonkey version 1.0.3 that corrects these issues. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. Updated packages Red Hat Desktop (v. 3) SRPMS: seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c IA-32: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282 seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9 seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87 seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a x86_64: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91 seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11 seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37 seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659 seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845 seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f Red Hat Enterprise Linux AS (v. 3) SRPMS: seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c IA-32: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282 seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9 seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87 seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a IA-64: seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830 seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084 seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2 seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72 seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8 seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98 PPC: seamonkey-1.0.3-0.el3.1.ppc.rpm 3557460aa7a520cf3ae737e97a23cabf seamonkey-chat-1.0.3-0.el3.1.ppc.rpm 5da4d6c953c2375ea944da5bbc6d65d7 seamonkey-devel-1.0.3-0.el3.1.ppc.rpm 4a13b4766810a93c338c6e61eb7c2878 seamonkey-dom-inspector-1.0.3-0.el3.1.ppc.rpm 43af0613aef928839f9953be9275976e seamonkey-js-debugger-1.0.3-0.el3.1.ppc.rpm 47c3640748bb8028f99fdc8df7143726 seamonkey-mail-1.0.3-0.el3.1.ppc.rpm 8b0ac20bf0eb1665c48503c1e0be2190 seamonkey-nspr-1.0.3-0.el3.1.ppc.rpm 81048df18d14782470b2191138ca1d1d seamonkey-nspr-devel-1.0.3-0.el3.1.ppc.rpm b086f5ca564b9dc92f7cb42d05cfe152 seamonkey-nss-1.0.3-0.el3.1.ppc.rpm 9bfb86324ed33e65b75a222e4f4d594c seamonkey-nss-devel-1.0.3-0.el3.1.ppc.rpm 8ead6a1dbcf7127d1be215be9386315f s390: seamonkey-1.0.3-0.el3.1.s390.rpm 484c596e85d071c16b60a4ff7b588cb2 seamonkey-chat-1.0.3-0.el3.1.s390.rpm 1d19478fe278e8810d37d0e53b843bdd seamonkey-devel-1.0.3-0.el3.1.s390.rpm 1cdd722aaf5be9fde448c5f6572af567 seamonkey-dom-inspector-1.0.3-0.el3.1.s390.rpm 1271e3bd7a31e1a61ed06ea92700316b seamonkey-js-debugger-1.0.3-0.el3.1.s390.rpm c48f29a1788d2724a0242b9905f4257f seamonkey-mail-1.0.3-0.el3.1.s390.rpm 2cdab0ae5eac44b1ce498dd30b7bbc37 seamonkey-nspr-1.0.3-0.el3.1.s390.rpm b846008adfbdad2b17be5016674c7bae seamonkey-nspr-devel-1.0.3-0.el3.1.s390.rpm bd9ddc4a63442bca42902f1ba24f36af seamonkey-nss-1.0.3-0.el3.1.s390.rpm bcb5e6d4273210272de5885cd4493df5 seamonkey-nss-devel-1.0.3-0.el3.1.s390.rpm 4931ae4f6b847dc3e9ad4e6a7cbff616 s390x: seamonkey-1.0.3-0.el3.1.s390x.rpm d575784f960eae10569f23e9b960539f seamonkey-chat-1.0.3-0.el3.1.s390x.rpm 13515109a27470d1473382feed63ac85 seamonkey-devel-1.0.3-0.el3.1.s390x.rpm dca79815a7bf6b1abc31c3d1da3f8b7d seamonkey-dom-inspector-1.0.3-0.el3.1.s390x.rpm 69658420caf319c4a87f9d08cb1f8b63 seamonkey-js-debugger-1.0.3-0.el3.1.s390x.rpm b3084333c4285c43b1e7f98d121459d4 seamonkey-mail-1.0.3-0.el3.1.s390x.rpm b1c98f83174a4294e6442fd85cc54c1e seamonkey-nspr-1.0.3-0.el3.1.s390.rpm b846008adfbdad2b17be5016674c7bae seamonkey-nspr-1.0.3-0.el3.1.s390x.rpm 94825bce286f505d30157ed388ec0851 seamonkey-nspr-devel-1.0.3-0.el3.1.s390x.rpm bd5db4932cf91db2e1ab44543bf88b24 seamonkey-nss-1.0.3-0.el3.1.s390.rpm bcb5e6d4273210272de5885cd4493df5 seamonkey-nss-1.0.3-0.el3.1.s390x.rpm bd25f904c8651f3339c6fb4110209673 seamonkey-nss-devel-1.0.3-0.el3.1.s390x.rpm 0317b5cc38abe9e5d753407e6053724f x86_64: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91 seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11 seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37 seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659 seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845 seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f Red Hat Enterprise Linux ES (v. 3) SRPMS: seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c IA-32: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282 seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9 seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87 seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a IA-64: seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830 seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084 seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2 seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72 seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8 seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98 x86_64: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91 seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11 seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37 seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659 seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845 seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f Red Hat Enterprise Linux WS (v. 3) SRPMS: seamonkey-1.0.3-0.el3.1.src.rpm 5700fda497d3d6e09cb99bd0160cae1c IA-32: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-chat-1.0.3-0.el3.1.i386.rpm 10bccb0c6f61cc913a5cee11e4525282 seamonkey-devel-1.0.3-0.el3.1.i386.rpm 4e0d353982d9c7c7779b394047a1cfd9 seamonkey-dom-inspector-1.0.3-0.el3.1.i386.rpm 9b47bc7c27efe287cfa0c07792ccc01e seamonkey-js-debugger-1.0.3-0.el3.1.i386.rpm 0ca5d34ca0b6db2c734ad126b6cb7b87 seamonkey-mail-1.0.3-0.el3.1.i386.rpm 80e793f420547aa0ffc9f55a5d6c790a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-devel-1.0.3-0.el3.1.i386.rpm 7b016fbdf8977d24272a6a9bf5c549eb seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-devel-1.0.3-0.el3.1.i386.rpm 0b0f7b284d7a43c701b8357a0636147a IA-64: seamonkey-1.0.3-0.el3.1.ia64.rpm b54f3e53c45f910fa925c78a3f85a830 seamonkey-chat-1.0.3-0.el3.1.ia64.rpm a54b5aa4c3aca436c9dea299d6f6a084 seamonkey-devel-1.0.3-0.el3.1.ia64.rpm 165d173c204d1194d809a01550477bb2 seamonkey-dom-inspector-1.0.3-0.el3.1.ia64.rpm 04c06e71a1e01ec3fb1b6d4921cf8e72 seamonkey-js-debugger-1.0.3-0.el3.1.ia64.rpm e7533e4ee79017f973b5efd8c263fbb8 seamonkey-mail-1.0.3-0.el3.1.ia64.rpm 6934faf2b40b265306fafa09eb7e2bdb seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.ia64.rpm 97ffb9cdeaa8c375248d7338e081705a seamonkey-nspr-devel-1.0.3-0.el3.1.ia64.rpm 15746c43e276091cca7b22e149968eec seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.ia64.rpm 3fa583ba5193eb5022a1492207af373e seamonkey-nss-devel-1.0.3-0.el3.1.ia64.rpm 430532e2827047ec6e95bd5fad698c98 x86_64: seamonkey-1.0.3-0.el3.1.i386.rpm edf47c00458eabb9a145b3a2d6211712 seamonkey-1.0.3-0.el3.1.x86_64.rpm d4c9f6d7193e758c20eaed2351bb2d91 seamonkey-chat-1.0.3-0.el3.1.x86_64.rpm f54fe75baa2c2fa5907cd0a8737efd11 seamonkey-devel-1.0.3-0.el3.1.x86_64.rpm 7762f692b3d621e8c47c392bd2c8031c seamonkey-dom-inspector-1.0.3-0.el3.1.x86_64.rpm e510b5446448432ba00053432c8a8d37 seamonkey-js-debugger-1.0.3-0.el3.1.x86_64.rpm 299196ad7affc2b288423aaa1e92829e seamonkey-mail-1.0.3-0.el3.1.x86_64.rpm 959424ae886ecf449f8cd657de5cf46a seamonkey-nspr-1.0.3-0.el3.1.i386.rpm dd0da039d35805b601e785791230b1b5 seamonkey-nspr-1.0.3-0.el3.1.x86_64.rpm 267086e1803aa3a62035f747cbbdb659 seamonkey-nspr-devel-1.0.3-0.el3.1.x86_64.rpm 7c636ad447bbd128e651262084d62bee seamonkey-nss-1.0.3-0.el3.1.i386.rpm b76d2bf3a842876e218395172a9390ee seamonkey-nss-1.0.3-0.el3.1.x86_64.rpm 03897b6821a7edfc3d9116a0b64a2845 seamonkey-nss-devel-1.0.3-0.el3.1.x86_64.rpm 1c0a8543ac1dd50e69bf5ac03c5f1d1f (The unlinked packages above are only available from the Red Hat Network) Bugs fixed (see bugzilla for more information) 200253 - CVE-2006-3801 Multiple Seamonkey issues (CVE-2006-3677, CVE-2006-3113, CVE-2006-3802, CVE-2006-3803, CVE-2006-3804, CVE-2006-3805, CVE-2006-3806, CVE-2006-3807, CVE-2006-3808, CVE-2006-3809, CVE-2006-3810, CVE-2006-3811, CVE-2006-3812) References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3113 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3677 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3801 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3802 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3803 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3804 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3805 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3806 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3807 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3808 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3809 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3810 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3811 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3812 http://www.redhat.com/security/updates/classification/#critical These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from: https://www.redhat.com/security/team/key/#package The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/ [***** End RHSA-2006:0608-6 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) Q-249: Vulnerability in PowerPoint Q-250: Multiple Vulnerabilities in Cisco Security Monitoring, Analysis and Response System (CS-MARS) Q-251: Oracle Critical Patch Update - July 2006 Q-252: libwmf Security Update Q-253: gimp Security Update Q-254: SeaMonkey Security Update (was Mozilla) Q-255: OpenSSH Security Update Q-256: Adobe Acrobat Buffer Overflow Vulnerability Q-257: PHP Security Update Q-258: Mozilla (now SeaMonkey), Firefox, Thunderbird Security Vulnerabilities