[thunderbird] [CVE-2008-0591] missing fix in USN-582-1/2?

[disabled.user]

Binary package hint: thunderbird

It seems like the latest USN for Thunderbird (see USN-582-1 and USN-582-2) misses a fix for CVE-2008-0591 when compared to:
- DSA-1485-1 (http://www.debian.org/security/2008/dsa-1485)
- MDVSA-2008:062 (http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:062)

If Ubuntu's Thunderbird is not affected by CVE-2008-0591, then sorry for reporting this, but I thought "better safe than sorry".

[Jamie Strandboge (jdstrand)]

The MFSA states that this only affected Firefox:
http://www.mozilla.org/security/announce/2008/mfsa2008-08.html

However the CVE lists Thunderbird below 2.0.0.12 is affected.

Alexander, is Thunderbird actually affected by this and in which update? I can update the USN accordingly if Thunderbird is affected.

[Alexander Sack (asac)]

On Tue, Dec 02, 2008 at 04:37:57PM -0000, Jamie Strandboge wrote:
> The MFSA states that this only affected Firefox:
> http://www.mozilla.org/security/announce/2008/mfsa2008-08.html
>
> However the CVE lists Thunderbird below 2.0.0.12 is affected.
>
> Alexander, is Thunderbird actually affected by this and in which update?
> I can update the USN accordingly if Thunderbird is affected.
>

Not sure why it wasnt declared to affect tbird. However, we have the
patch in both: tbird 2 and in 1.5 branch used in dapper ... so we
should be save.

 - Alexander