Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 163286 - CAN-2005-0989 multiple thunderbird issues (CAN-2005-1159 CAN-2005-1160 CAN-2005-1532 CAN-2005-2261 CAN-2005-2265 CAN-2005-2266 CAN-2005-2269 CAN-2005-2270)
Summary: CAN-2005-0989 multiple thunderbird issues (CAN-2005-1159 CAN-2005-1160 CAN-20...
Alias: None
Product: Fedora
Classification: Fedora
Component: thunderbird
Version: 4
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Christopher Aillon
QA Contact:
Whiteboard: impact=important,source=mozilla,publi...
Depends On:
TreeView+ depends on / blocked
Reported: 2005-07-14 19:55 UTC by Josh Bressers
Modified: 2007-11-30 22:11 UTC (History)
1 user (show)

Fixed In Version: 1.0.7-1.1
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2005-10-09 10:14:21 UTC

Attachments (Terms of Use)

Description Josh Bressers 2005-07-14 19:55:14 UTC
+++ This bug was initially created as a clone of Bug #163285 +++

MFSA 2005-56
            Improper cloning of base objects allowed web content scripts to
            get to a privileged object by walking up the prototype chain. This
            could be used to execute code with enhanced privileges.


        MFSA 2005-55
            Parts of the browser UI relied too much on DOM node names without
            taking different namespaces into account and verifying that the
            node was really of the expected type. An XHTML document could be
            used, for example, to create fake <IMG> elements with
            content-defined properties that will be accessed as if they were
            the trusted built-in properties of the expected HTML elements.


        MFSA 2005-52
            A child frame can call top.focus() even if the framing page comes
            from a different origin and has overridden the focus() routine.
            The call is made in the context of the child frame. The attacker
            would look for a target site with a framed page that makes this
            call but doesn't verify that its parent comes from the same site.
            By framing this page the attacker could steal cookies and
            passwords, or take actions on the site on behalf of a signed-in


        MFSA 2005-50
            When InstallVersion.compareTo() is passed an object rather than a
            string it assumed the object was another InstallVersion without
            verifying it. When passed a different kind of object the browser
            would generally crash with an access violation.

        MFSA 2005-46
            Scripts in XBL controls from web content continued to be run even
            when Javascript was disabled. By itself this causes no harm, but
            it could be combined with most script-based exploits to attack
            people running vulnerable versions who thought disabling
            javascript would protect them.


        MFSA 2005-44
            Additional checks were added to make sure Javascript eval and
            Script objects are run with the privileges of the context that
            created them, not the potentially elevated privilege of the
            context calling them in order to protect against an additional
            variant of MFSA 2005-41.


        MFSA 2005-41
            moz_bug_r_a4 reported several exploits giving an attacker the
            ability to install malicious code or steal data, requiring only
            that the user do commonplace actions like click on a link or open
            the context menu. The common cause in each case was privileged UI
            code ("chrome") being overly trusting of DOM nodes from the
            content window.  Scripts in the web page can override properties
            and methods of DOM nodes and shadow the native values, unless
            steps are taken to get the true underlying values.


        MFSA 2005-40

            The native implementations of InstallTrigger and other
            XPInstall-related javascript objects did not properly validate
            that they were called on instances of the correct type. By passing
            other objects, even raw numbers, the javascript interpreter would
            jump to the wrong place in memory.  Although no proof of concept
            has been developed we believe this could be exploited.


        MFSA 2005-33

            A bug in javascript's regular expression string replacement when
            using an anonymous function as the replacement argument allows a
            malicious script to capture blocks of memory allocated to the
            browser. A web site could capture data and transmit it to a server
            without user interaction or knowledge.


Comment 1 Gerwin Krist 2005-10-09 10:14:21 UTC
Thank you for the bug reports. These particular bugs are fixed and a updated
packages were published for download. Please feel free to report any further
bugs you find.

MFSA 2005-56 -> fixed in 1.03
MFSA 2005-55 -> fixed in 1.05
MFSA 2005-52 -> fixed in 1.05
MFSA 2005-50 -> fixed in 1.05
MFSA 2005-46 -> fixed in 1.05
MFSA 2005-44 -> fixed in 1.04
MFSA 2005-41 -> fixed in 1.03
MFSA 2005-40 -> fixed in 1.03
MFSA 2005-33 -> fixed in 1.03

Note You need to log in before you can comment on or make changes to this bug.