Debian DSA-1830-1 : icedove - several vulnerabilities

Critical Nessus Plugin ID 44695

Synopsis

The remote Debian host is missing a security-related update.

Description

Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2009-0040 The execution of arbitrary code might be possible via a crafted PNG file that triggers a free of an uninitialized pointer in (1) the png_read_png function, (2) pCAL chunk handling, or (3) setup of 16-bit gamma tables. (MFSA 2009-10)

- CVE-2009-0352 It is possible to execute arbitrary code via vectors related to the layout engine. (MFSA 2009-01)

- CVE-2009-0353 It is possible to execute arbitrary code via vectors related to the JavaScript engine. (MFSA 2009-01)

- CVE-2009-0652 Bjoern Hoehrmann and Moxie Marlinspike discovered a possible spoofing attack via Unicode box drawing characters in internationalized domain names. (MFSA 2009-15)

- CVE-2009-0771 Memory corruption and assertion failures have been discovered in the layout engine, leading to the possible execution of arbitrary code. (MFSA 2009-07)

- CVE-2009-0772 The layout engine allows the execution of arbitrary code in vectors related to nsCSSStyleSheet::GetOwnerNode, events, and garbage collection. (MFSA 2009-07)

- CVE-2009-0773 The JavaScript engine is prone to the execution of arbitrary code via several vectors. (MFSA 2009-07)

- CVE-2009-0774 The layout engine allows the execution of arbitrary code via vectors related to gczeal. (MFSA 2009-07)

- CVE-2009-0776 Georgi Guninski discovered that it is possible to obtain xml data via an issue related to the nsIRDFService.
(MFSA 2009-09)

- CVE-2009-1302 The browser engine is prone to a possible memory corruption via several vectors. (MFSA 2009-14)

- CVE-2009-1303 The browser engine is prone to a possible memory corruption via the nsSVGElement::BindToTree function.
(MFSA 2009-14)

- CVE-2009-1307 Gregory Fleischer discovered that it is possible to bypass the Same Origin Policy when opening a Flash file via the view-source: scheme. (MFSA 2009-17)

- CVE-2009-1832 The possible arbitrary execution of code was discovered via vectors involving 'double frame construction.' (MFSA 2009-24)

- CVE-2009-1392 Several issues were discovered in the browser engine as used by icedove, which could lead to the possible execution of arbitrary code. (MFSA 2009-24)

- CVE-2009-1836 Shuo Chen, Ziqing Mao, Yi-Min Wang and Ming Zhang reported a potential man-in-the-middle attack, when using a proxy due to insufficient checks on a certain proxy response. (MFSA 2009-27)

- CVE-2009-1838 moz_bug_r_a4 discovered that it is possible to execute arbitrary JavaScript with chrome privileges due to an error in the garbage collection implementation. (MFSA 2009-29)

- CVE-2009-1841 moz_bug_r_a4 reported that it is possible for scripts from page content to run with elevated privileges and thus potentially executing arbitrary code with the object's chrome privileges. (MFSA 2009-32)

- No CVE id yet

Bernd Jendrissek discovered a potentially exploitable crash when viewing a multipart/alternative mail message with a text/enhanced part. (MFSA 2009-33)

Solution

Upgrade the icedove packages.

For the stable distribution (lenny), these problems have been fixed in version 2.0.0.22-0lenny1.

As indicated in the Etch release notes, security support for the Mozilla products in the oldstable distribution needed to be stopped before the end of the regular Etch security maintenance life cycle.
You are strongly encouraged to upgrade to stable or switch to a still supported mail client.

For the testing (squeeze) distribution these problems will be fixed soon.

See Also

https://security-tracker.debian.org/tracker/CVE-2009-0040

https://security-tracker.debian.org/tracker/CVE-2009-0352

https://security-tracker.debian.org/tracker/CVE-2009-0353

https://security-tracker.debian.org/tracker/CVE-2009-0652

https://security-tracker.debian.org/tracker/CVE-2009-0771

https://security-tracker.debian.org/tracker/CVE-2009-0772

https://security-tracker.debian.org/tracker/CVE-2009-0773

https://security-tracker.debian.org/tracker/CVE-2009-0774

https://security-tracker.debian.org/tracker/CVE-2009-0776

https://security-tracker.debian.org/tracker/CVE-2009-1302

https://security-tracker.debian.org/tracker/CVE-2009-1303

https://security-tracker.debian.org/tracker/CVE-2009-1307

https://security-tracker.debian.org/tracker/CVE-2009-1832

https://security-tracker.debian.org/tracker/CVE-2009-1392

https://security-tracker.debian.org/tracker/CVE-2009-1836

https://security-tracker.debian.org/tracker/CVE-2009-1838

https://security-tracker.debian.org/tracker/CVE-2009-1841

https://www.debian.org/security/2009/dsa-1830

Plugin Details

Severity: Critical

ID: 44695

File Name: debian_DSA-1830.nasl

Version: 1.19

Type: local

Agent: unix

Published: 2010/02/24

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: Critical

CVSS v2.0

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:icedove, cpe:/o:debian:debian_linux:5.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2009/07/12

Vulnerability Publication Date: 2009/02/04

Reference Information

CVE: CVE-2009-0040, CVE-2009-0352, CVE-2009-0353, CVE-2009-0652, CVE-2009-0771, CVE-2009-0772, CVE-2009-0773, CVE-2009-0774, CVE-2009-0776, CVE-2009-1302, CVE-2009-1303, CVE-2009-1307, CVE-2009-1392, CVE-2009-1832, CVE-2009-1836, CVE-2009-1838, CVE-2009-1841

BID: 33598, 33990, 35370, 35371, 35373, 35380, 35383

DSA: 1830

CWE: 16, 20, 94, 200, 287, 399