Bug #22260 “shell command execution” : Bugs : mozilla-thunderbird package : Ubuntu

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#1

Automatically imported from Debian bug report #329664 http://bugs.debian.org/329664

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-22:

#2

Message-id: <email address hidden>
Date: Thu, 22 Sep 2005 16:53:02 +0200
From: Sebastian Ley <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: shell command execution

Package: mozilla-thunderbird
Severity: grave
Tags: security

Secunia reports in http://secunia.com/advisories/16901/ that thunderbird
can be exploited to execute arbitrary shell commands in the context of
the user running thuderbird.

This bug has been assigned CAN-2005-2968.

-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-1-686
Locale: LANG=de_DE@euro, LC_CTYPE=de_DE@euro (charmap=ISO-8859-15)

Revision history for this message

In Debian Bug tracker #329664, Y Giridhar Appaji Nag (debian-appaji) wrote on 2005-09-23: Re: Bug#329667: mozilla-thunderbird --compose executes shell commands

#3

merge 329664 329667
thanks

On 05/09/22 17:27 +0200, Florian Weimer said ...
> Package: mozilla-thunderbird
> Version: 1.0.6-3
> Severity: grave
> Tags: security
>
> The --compose option executes shell commands:
>
> mozilla-thunderbird --compose 'mailto:`df`'
>
> The df output appears in the To: line of the message.
>
> (This is related to the recently disclosed Firefox bug, which does not
> seem to affect Debian thanks to a different wrapper script.)

--
Y Giridhar Appaji Nag | http://www.appaji.net/

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-23:

#4

Message-ID: <email address hidden>
Date: Fri, 23 Sep 2005 15:41:02 +0530
From: Y Giridhar Appaji Nag <email address hidden>
To: Florian Weimer <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#329667: mozilla-thunderbird --compose executes shell commands

merge 329664 329667
thanks

On 05/09/22 17:27 +0200, Florian Weimer said ...
> Package: mozilla-thunderbird
> Version: 1.0.6-3
> Severity: grave
> Tags: security
>
> The --compose option executes shell commands:
>
> mozilla-thunderbird --compose 'mailto:`df`'
>
> The df output appears in the To: line of the message.
>
> (This is related to the recently disclosed Firefox bug, which does not
> seem to affect Debian thanks to a different wrapper script.)

--
Y Giridhar Appaji Nag | http://www.appaji.net/

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-23:

#5

*** Bug 22261 has been marked as a duplicate of this bug. ***

Revision history for this message

In Debian Bug tracker #329664, Alexander Sack (asac) wrote on 2005-09-26: setting pending upload

#6

tags 329664 + pending
tags 329667 + pending
tags 325536 + pending
tags 292475 + pending
thanks

I will wait one or two more days, because mozilla is about to release
1.0.7 which addresses several security issues.

Setting pending, because the 1.0.6 package is ready here.

- Alexander

p.s. please take care that the bug is listed as To: or CC: when
replying to this mail (e.g. /reply-all/).
--
GPG messages preferred. | .''`. ** Debian GNU/Linux **
Alexander Sack | : :' : The universal
<email address hidden> | `. `' Operating System
http://www.asoftsite.org | `- http://www.debian.org/

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-26:

#7

Message-ID: <email address hidden>
Date: Mon, 26 Sep 2005 12:21:53 +0200
From: Alexander Sack - Debian Bugmail <email address hidden>
To: <email address hidden>
Cc: <email address hidden>, <email address hidden>, <email address hidden>,
<email address hidden>
Subject: setting pending upload

tags 329664 + pending
tags 329667 + pending
tags 325536 + pending
tags 292475 + pending
thanks

I will wait one or two more days, because mozilla is about to release
1.0.7 which addresses several security issues.

Setting pending, because the 1.0.6 package is ready here.

- Alexander

p.s. please take care that the bug is listed as To: or CC: when
replying to this mail (e.g. /reply-all/).
--
GPG messages preferred. | .''`. ** Debian GNU/Linux **
Alexander Sack | : :' : The universal
<email address hidden> | `. `' Operating System
http://www.asoftsite.org | `- http://www.debian.org/

Revision history for this message

In Debian Bug tracker #329664, Alexander Sack (asac) wrote on 2005-09-29: Bug#329667: fixed in mozilla-thunderbird 1.0.6-4

#8

Download full text (4.8 KiB)

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes:
mozilla-thunderbird (1.0.6-4) unstable; urgency=high
.
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by Florian Weimer <email address hidden>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <email address hidden>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <email address hidden>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the ...

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329667@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes: 
 mozilla-thunderbird (1.0.6-4) unstable; urgency=high
 .
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by  Florian Weimer <fw@deneb.enyo.de>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian.org>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <debian@appaji.net>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the /var/... adding a link to the new location.
     (Closes: 292475)
   * added depends for system libs: mng, png, jpeg to not build with
     unmaintained image included libs.
   * modified 21_mozilla_in-patch.dpatch to recognize -mail as a -compose
     alias. This makes thunderbird work well with current gnome default
     mailto: command for thunderbird. Thanks to Sam Morris <sam@robots.org.uk>
     for the workaround patch (Closes: 330168)
   * still work left: fix window.open(); overlay problem.
     added rejar-chrome.sh <jarbasename> util script below debian. It
     rejars .jar files by extracting paths given in
     <jarbasename>_jar_includes.csv from the <jarbasename>.jar zip file
     and zipping only those files to a new jar file again. Anyway, still
     broken, thus disabled for this build.
     (See: 306522)
Files: 
 d8cac0bb89779e7a7785b7c68ce12bb7 941 mail optional mozilla-thunderbird_1.0.6-4.dsc
 ad549747c0e7af96a337e8a05f67d3a1 102661 mail optional mozilla-thunderbird_1.0.6-4.diff.gz
 392eef2e55222811f30393f21407ef4a 10619190 mail optional mozilla-thunderbird_1.0.6-4_i386.deb
 fdd68da4c517956f8a68c98d8ab95a14 27756 mail optional mozilla-thunderbird-offline_1.0.6-4_i386.deb
 3a69f96c3b7ab94c8fc7eb2ae1da3e18 140132 mail optional mozilla-thunderbird-inspector_1.0.6-4_i386.deb
 03b70dcd9e9839eb2ff085ec4ce130eb 79112 mail optional mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
 5270348baa4debe46653796883d31b73 3489466 mail optional mozilla-thunderbird-dev_1.0.6-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDO+njv8pLOKgkuT8RAsYuAKCvLzhCHfNFjEtXMBEkio5TGAYwlACgnsJL
d3Ldn9GIDeLCt45S16hP7fs=
=Xxg0
-----END PGP SIGNATURE-----

Revision history for this message

In Debian Bug tracker #329664, Alexander Sack (asac) wrote on 2005-09-29: Bug#329664: fixed in mozilla-thunderbird 1.0.6-4

#9

Download full text (4.8 KiB)

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes:
mozilla-thunderbird (1.0.6-4) unstable; urgency=high
.
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by Florian Weimer <email address hidden>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <email address hidden>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <email address hidden>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the ...

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes: 
 mozilla-thunderbird (1.0.6-4) unstable; urgency=high
 .
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by  Florian Weimer <fw@deneb.enyo.de>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian.org>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <debian@appaji.net>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the /var/... adding a link to the new location.
     (Closes: 292475)
   * added depends for system libs: mng, png, jpeg to not build with
     unmaintained image included libs.
   * modified 21_mozilla_in-patch.dpatch to recognize -mail as a -compose
     alias. This makes thunderbird work well with current gnome default
     mailto: command for thunderbird. Thanks to Sam Morris <sam@robots.org.uk>
     for the workaround patch (Closes: 330168)
   * still work left: fix window.open(); overlay problem.
     added rejar-chrome.sh <jarbasename> util script below debian. It
     rejars .jar files by extracting paths given in
     <jarbasename>_jar_includes.csv from the <jarbasename>.jar zip file
     and zipping only those files to a new jar file again. Anyway, still
     broken, thus disabled for this build.
     (See: 306522)
Files: 
 d8cac0bb89779e7a7785b7c68ce12bb7 941 mail optional mozilla-thunderbird_1.0.6-4.dsc
 ad549747c0e7af96a337e8a05f67d3a1 102661 mail optional mozilla-thunderbird_1.0.6-4.diff.gz
 392eef2e55222811f30393f21407ef4a 10619190 mail optional mozilla-thunderbird_1.0.6-4_i386.deb
 fdd68da4c517956f8a68c98d8ab95a14 27756 mail optional mozilla-thunderbird-offline_1.0.6-4_i386.deb
 3a69f96c3b7ab94c8fc7eb2ae1da3e18 140132 mail optional mozilla-thunderbird-inspector_1.0.6-4_i386.deb
 03b70dcd9e9839eb2ff085ec4ce130eb 79112 mail optional mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
 5270348baa4debe46653796883d31b73 3489466 mail optional mozilla-thunderbird-dev_1.0.6-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDO+njv8pLOKgkuT8RAsYuAKCvLzhCHfNFjEtXMBEkio5TGAYwlACgnsJL
d3Ldn9GIDeLCt45S16hP7fs=
=Xxg0
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-29:

#10

Download full text (5.0 KiB)

Message-Id: <email address hidden>
Date: Thu, 29 Sep 2005 06:32:14 -0700
From: Alexander Sack <email address hidden>
To: <email address hidden>
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.6-4

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes:
mozilla-thunderbird (1.0.6-4) unstable; urgency=high
.
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by Florian Weimer <email address hidden>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian....

Message-Id: <E1EKyWE-0001Qp-00@spohr.debian.org>
Date: Thu, 29 Sep 2005 06:32:14 -0700
From: Alexander Sack <asac@debian.org>
To: 329664-close@bugs.debian.org
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.6-4

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes: 
 mozilla-thunderbird (1.0.6-4) unstable; urgency=high
 .
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by  Florian Weimer <fw@deneb.enyo.de>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian.org>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <debian@appaji.net>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the /var/... adding a link to the new location.
     (Closes: 292475)
   * added depends for system libs: mng, png, jpeg to not build with
     unmaintained image included libs.
   * modified 21_mozilla_in-patch.dpatch to recognize -mail as a -compose
     alias. This makes thunderbird work well with current gnome default
     mailto: command for thunderbird. Thanks to Sam Morris <sam@robots.org.uk>
     for the workaround patch (Closes: 330168)
   * still work left: fix window.open(); overlay problem.
     added rejar-chrome.sh <jarbasename> util script below debian. It
     rejars .jar files by extracting paths given in
     <jarbasename>_jar_includes.csv from the <jarbasename>.jar zip file
     and zipping only those files to a new jar file again. Anyway, still
     broken, thus disabled for this build.
     (See: 306522)
Files: 
 d8cac0bb89779e7a7785b7c68ce12bb7 941 mail optional mozilla-thunderbird_1.0.6-4.dsc
 ad549747c0e7af96a337e8a05f67d3a1 102661 mail optional mozilla-thunderbird_1.0.6-4.diff.gz
 392eef2e55222811f30393f21407ef4a 10619190 mail optional mozilla-thunderbird_1.0.6-4_i386.deb
 fdd68da4c517956f8a68c98d8ab95a14 27756 mail optional mozilla-thunderbird-offline_1.0.6-4_i386.deb
 3a69f96c3b7ab94c8fc7eb2ae1da3e18 140132 mail optional mozilla-thunderbird-inspector_1.0.6-4_i386.deb
 03b70dcd9e9839eb2ff085ec4ce130eb 79112 mail optional mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
 5270348baa4debe46653796883d31b73 3489466 mail optional mozilla-thunderbird-dev_1.0.6-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDO+njv8pLOKgkuT8RAsYuAKCvLzhCHfNFjEtXMBEkio5TGAYwlACgnsJL
d3Ldn9GIDeLCt45S16hP7fs=
=Xxg0
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-09-29:

#11

Download full text (5.0 KiB)

Message-Id: <email address hidden>
Date: Thu, 29 Sep 2005 06:32:14 -0700
From: Alexander Sack <email address hidden>
To: <email address hidden>
Subject: Bug#329667: fixed in mozilla-thunderbird 1.0.6-4

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes:
mozilla-thunderbird (1.0.6-4) unstable; urgency=high
.
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by Florian Weimer <email address hidden>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian....

Message-Id: <E1EKyWE-0001Qr-00@spohr.debian.org>
Date: Thu, 29 Sep 2005 06:32:14 -0700
From: Alexander Sack <asac@debian.org>
To: 329667-close@bugs.debian.org
Subject: Bug#329667: fixed in mozilla-thunderbird 1.0.6-4

Source: mozilla-thunderbird
Source-Version: 1.0.6-4

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.6-4_i386.deb
mozilla-thunderbird-inspector_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.6-4_i386.deb
mozilla-thunderbird-offline_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.6-4_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
mozilla-thunderbird_1.0.6-4.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.diff.gz
mozilla-thunderbird_1.0.6-4.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4.dsc
mozilla-thunderbird_1.0.6-4_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.6-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329667@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 23 Sep 2005 17:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.6-4
Distribution: unstable
Urgency: high
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 292475 325536 329664 329667 330168
Changes: 
 mozilla-thunderbird (1.0.6-4) unstable; urgency=high
 .
   * now using bash to overcome possible security flaws of
     our thunderbird start script (mozilla-thunderbird). Patch
     by  Florian Weimer <fw@deneb.enyo.de>
     debian/mfsa_2005-59.debian.patch (Closes: 329664, 329667)
   * added patch 50_ftbfs_alpha+arm+ia64_325536_fix.dpatch
     to build on alpha, arm, and ia64 that now uses
     __attribute__((used)) instead of ((unused)) by
     Steve Langasek <vorlon@debian.org>
     (Closes: 325536)
   * fix debsums error reported by Y Giridhar Appaji Nag
     <debian@appaji.net>. Now removing files in postrm.
     Further moved /usr/lib/mozilla-thunderbird/chrome/chrome.rdf
     to the /var/... adding a link to the new location.
     (Closes: 292475)
   * added depends for system libs: mng, png, jpeg to not build with
     unmaintained image included libs.
   * modified 21_mozilla_in-patch.dpatch to recognize -mail as a -compose
     alias. This makes thunderbird work well with current gnome default
     mailto: command for thunderbird. Thanks to Sam Morris <sam@robots.org.uk>
     for the workaround patch (Closes: 330168)
   * still work left: fix window.open(); overlay problem.
     added rejar-chrome.sh <jarbasename> util script below debian. It
     rejars .jar files by extracting paths given in
     <jarbasename>_jar_includes.csv from the <jarbasename>.jar zip file
     and zipping only those files to a new jar file again. Anyway, still
     broken, thus disabled for this build.
     (See: 306522)
Files: 
 d8cac0bb89779e7a7785b7c68ce12bb7 941 mail optional mozilla-thunderbird_1.0.6-4.dsc
 ad549747c0e7af96a337e8a05f67d3a1 102661 mail optional mozilla-thunderbird_1.0.6-4.diff.gz
 392eef2e55222811f30393f21407ef4a 10619190 mail optional mozilla-thunderbird_1.0.6-4_i386.deb
 fdd68da4c517956f8a68c98d8ab95a14 27756 mail optional mozilla-thunderbird-offline_1.0.6-4_i386.deb
 3a69f96c3b7ab94c8fc7eb2ae1da3e18 140132 mail optional mozilla-thunderbird-inspector_1.0.6-4_i386.deb
 03b70dcd9e9839eb2ff085ec4ce130eb 79112 mail optional mozilla-thunderbird-typeaheadfind_1.0.6-4_i386.deb
 5270348baa4debe46653796883d31b73 3489466 mail optional mozilla-thunderbird-dev_1.0.6-4_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDO+njv8pLOKgkuT8RAsYuAKCvLzhCHfNFjEtXMBEkio5TGAYwlACgnsJL
d3Ldn9GIDeLCt45S16hP7fs=
=Xxg0
-----END PGP SIGNATURE-----

Revision history for this message

Adam Conrad (adconrad) wrote on 2005-10-27:

#12

This was fixed in all releases with the various 1.0.7 uploads.

Revision history for this message

In Debian Bug tracker #329664, Alexander Sack (asac) wrote on 2005-11-12: Bug#329664: fixed in mozilla-thunderbird 1.0.2-2.sarge1.0.7

#13

Download full text (5.8 KiB)

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes:
mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
.
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
.
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
       name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 ...

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes: 
 mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
 .
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
 .
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
 	     name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   * MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
 	     of "critical" have been released in Mozilla Firefox/Thunderbird
 	     1.0.7 and the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
 	     CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
 	      306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing, tbird is not affected
         applied anyway to keep source in sync.
       + CAN-2005-2702 - Crash on "zero-width non-joiner" sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   * MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
 	     are not correctly protected against interpretation by the
 	     shell. As a result a malicious URL can result in the execution
 	     of shell commands with the privileges of the user. If Firefox
 	     is set as the default handler for web URLs then opening a URL
 	     in another program (for example, links in a mail or chat
 	     client) can result in shell command execution.
     Closes: 329664,329664
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution
Files: 
 303ed28d7dac19a27a47c23819f80bd7 997 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
 79fbaf89373ea1d4698942f289b556d2 210991 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
 fc8572c0a89b914fc288fd638e224213 11550326 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
 ec039bd40938c0d6bb87874cc8703c25 27286 mail optional mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
 a90c517acdcaf177b4585cf8f9e35344 140456 mail optional mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
 ecf0d09362306bcd6c8a65c2e779f792 81696 mail optional mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
 02fbded3b5e503def6c29f32c34b24d1 3497080 mail optional mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDQAAMv8pLOKgkuT8RAp6QAKCY/VbjrWCngixYOdu2MQK2URdpsgCeIeBS
gr2DrdhaXYVioWnS4kjhsPs=
=HZnU
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-11-12:

#14

Download full text (6.0 KiB)

Message-Id: <email address hidden>
Date: Sat, 12 Nov 2005 01:03:49 -0800
From: Alexander Sack <email address hidden>
To: <email address hidden>
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.2-2.sarge1.0.7

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes:
mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
.
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
.
   * MFSA-2005-57: IDN heap overrun
     Summary: ...

Message-Id: <E1EarIb-000105-Kx@spohr.debian.org>
Date: Sat, 12 Nov 2005 01:03:49 -0800
From: Alexander Sack <asac@debian.org>
To: 329664-close@bugs.debian.org
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.2-2.sarge1.0.7

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes: 
 mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
 .
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
 .
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
 	     name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   * MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
 	     of "critical" have been released in Mozilla Firefox/Thunderbird
 	     1.0.7 and the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
 	     CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
 	      306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing, tbird is not affected
         applied anyway to keep source in sync.
       + CAN-2005-2702 - Crash on "zero-width non-joiner" sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   * MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
 	     are not correctly protected against interpretation by the
 	     shell. As a result a malicious URL can result in the execution
 	     of shell commands with the privileges of the user. If Firefox
 	     is set as the default handler for web URLs then opening a URL
 	     in another program (for example, links in a mail or chat
 	     client) can result in shell command execution.
     Closes: 329664,329664
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution
Files: 
 303ed28d7dac19a27a47c23819f80bd7 997 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
 79fbaf89373ea1d4698942f289b556d2 210991 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
 fc8572c0a89b914fc288fd638e224213 11550326 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
 ec039bd40938c0d6bb87874cc8703c25 27286 mail optional mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
 a90c517acdcaf177b4585cf8f9e35344 140456 mail optional mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
 ecf0d09362306bcd6c8a65c2e779f792 81696 mail optional mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
 02fbded3b5e503def6c29f32c34b24d1 3497080 mail optional mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDQAAMv8pLOKgkuT8RAp6QAKCY/VbjrWCngixYOdu2MQK2URdpsgCeIeBS
gr2DrdhaXYVioWnS4kjhsPs=
=HZnU
-----END PGP SIGNATURE-----

Revision history for this message

In Debian Bug tracker #329664, Alexander Sack (asac) wrote on 2005-12-17:

#15

Download full text (5.8 KiB)

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes:
mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
.
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
.
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
       name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 ...

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes: 
 mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
 .
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
 .
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
 	     name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   * MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
 	     of "critical" have been released in Mozilla Firefox/Thunderbird
 	     1.0.7 and the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
 	     CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
 	      306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing, tbird is not affected
         applied anyway to keep source in sync.
       + CAN-2005-2702 - Crash on "zero-width non-joiner" sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   * MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
 	     are not correctly protected against interpretation by the
 	     shell. As a result a malicious URL can result in the execution
 	     of shell commands with the privileges of the user. If Firefox
 	     is set as the default handler for web URLs then opening a URL
 	     in another program (for example, links in a mail or chat
 	     client) can result in shell command execution.
     Closes: 329664,329664
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution
Files: 
 303ed28d7dac19a27a47c23819f80bd7 997 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
 79fbaf89373ea1d4698942f289b556d2 210991 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
 fc8572c0a89b914fc288fd638e224213 11550326 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
 ec039bd40938c0d6bb87874cc8703c25 27286 mail optional mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
 a90c517acdcaf177b4585cf8f9e35344 140456 mail optional mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
 ecf0d09362306bcd6c8a65c2e779f792 81696 mail optional mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
 02fbded3b5e503def6c29f32c34b24d1 3497080 mail optional mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDQAAMv8pLOKgkuT8RAp6QAKCY/VbjrWCngixYOdu2MQK2URdpsgCeIeBS
gr2DrdhaXYVioWnS4kjhsPs=
=HZnU
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2005-12-17:

#16

Download full text (6.0 KiB)

Message-Id: <email address hidden>
Date: Fri, 16 Dec 2005 21:34:54 -0800
From: Alexander Sack <email address hidden>
To: <email address hidden>
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.2-2.sarge1.0.7

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <email address hidden> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <email address hidden>
Changed-By: Alexander Sack <email address hidden>
Description:
mozilla-thunderbird - Mozilla Thunderbird standalone mail client
mozilla-thunderbird-dev - mozilla thunderbird development files
mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
mozilla-thunderbird-offline - mozilla thunderbird offline extension
mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes:
mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
.
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
.
   * MFSA-2005-57: IDN heap overrun
     Summary: ...

Message-Id: <E1EnUic-0000e2-9f@spohr.debian.org>
Date: Fri, 16 Dec 2005 21:34:54 -0800
From: Alexander Sack <asac@debian.org>
To: 329664-close@bugs.debian.org
Subject: Bug#329664: fixed in mozilla-thunderbird 1.0.2-2.sarge1.0.7

Source: mozilla-thunderbird
Source-Version: 1.0.2-2.sarge1.0.7

We believe that the bug you reported is fixed in the latest version of
mozilla-thunderbird, which is due to be installed in the Debian FTP archive:

mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
  to pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 329664@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated mozilla-thunderbird package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Sat, 1 Oct 2005 11:00:00 +0100
Source: mozilla-thunderbird
Binary: mozilla-thunderbird-dev mozilla-thunderbird-inspector mozilla-thunderbird mozilla-thunderbird-typeaheadfind mozilla-thunderbird-offline
Architecture: source i386
Version: 1.0.2-2.sarge1.0.7
Distribution: stable-security
Urgency: critical
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 mozilla-thunderbird - Mozilla Thunderbird standalone mail client
 mozilla-thunderbird-dev - mozilla thunderbird development files
 mozilla-thunderbird-inspector - mozilla thunderbird dom inspector extension
 mozilla-thunderbird-offline - mozilla thunderbird offline extension
 mozilla-thunderbird-typeaheadfind - mozilla thunderbird typeaheadfind extension
Closes: 329664 329664
Changes: 
 mozilla-thunderbird (1.0.2-2.sarge1.0.7) stable-security; urgency=critical
 .
   * following issues are addressed with patches in
     debian/patches/tbird.1.0.6-1.0.7-1/. MFSA_2005-59 has a debian specific
     patch: debian/mfsa_2005-59.debian.patch.
 .
   * MFSA-2005-57: IDN heap overrun
     Summary: Tom Ferris reported a Firefox crash when processing a domain
 	     name consisting solely of soft-hyphen characters.
     Closes: -
     CVE-Ids: CAN-2005-2871
     Bugzilla: 307259
     Issues addressed:
       + CAN-2005-2871 - IDN heap overrun
   * MFSA-2005-58: Accumulated vendor advisory for multiple vulnerabilities
     Summary: Fixes for multiple vulnerabilities with an overall severity
 	     of "critical" have been released in Mozilla Firefox/Thunderbird
 	     1.0.7 and the Mozilla Suite 1.7.12
     Closes: -
     CVE-Ids: CAN-2005-2701 CAN-2005-2702 CAN-2005-2703 CAN-2005-2704
 	     CAN-2005-2705 CAN-2005-2706 CAN-2005-2707
     Bugzilla: 300936 296134 297078 302263 299518 303213 304754 306261
 	      306804 291178 300853 301180 302100
     Issues addressed:
       + CAN-2005-2701 - Heap overrun in XBM image processing, tbird is not affected
         applied anyway to keep source in sync.
       + CAN-2005-2702 - Crash on "zero-width non-joiner" sequence
       + CAN-2005-2703 - XMLHttpRequest header spoofing
       + CAN-2005-2704 - Object spoofing using XBL <implements>
       + CAN-2005-2705 - JavaScript integer overflow
       + CAN-2005-2706 - Privilege escalation using about: scheme
       + CAN-2005-2707 - Chrome window spoofing
       + Regression fixes
   * MFSA-2005-59: Command-line handling on Linux allows shell execution
     Summary: URLs passed to Linux versions of Firefox on the command-line
 	     are not correctly protected against interpretation by the
 	     shell. As a result a malicious URL can result in the execution
 	     of shell commands with the privileges of the user. If Firefox
 	     is set as the default handler for web URLs then opening a URL
 	     in another program (for example, links in a mail or chat
 	     client) can result in shell command execution.
     Closes: 329664,329664
     CVE-Ids: CAN-2005-2968
     Bugzilla: 307185
     Issues addressed:
       + CAN-2005-2968 - Command-line handling on Linux allows shell execution
Files: 
 303ed28d7dac19a27a47c23819f80bd7 997 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.dsc
 79fbaf89373ea1d4698942f289b556d2 210991 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7.diff.gz
 fc8572c0a89b914fc288fd638e224213 11550326 mail optional mozilla-thunderbird_1.0.2-2.sarge1.0.7_i386.deb
 ec039bd40938c0d6bb87874cc8703c25 27286 mail optional mozilla-thunderbird-offline_1.0.2-2.sarge1.0.7_i386.deb
 a90c517acdcaf177b4585cf8f9e35344 140456 mail optional mozilla-thunderbird-inspector_1.0.2-2.sarge1.0.7_i386.deb
 ecf0d09362306bcd6c8a65c2e779f792 81696 mail optional mozilla-thunderbird-typeaheadfind_1.0.2-2.sarge1.0.7_i386.deb
 02fbded3b5e503def6c29f32c34b24d1 3497080 mail optional mozilla-thunderbird-dev_1.0.2-2.sarge1.0.7_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDQAAMv8pLOKgkuT8RAp6QAKCY/VbjrWCngixYOdu2MQK2URdpsgCeIeBS
gr2DrdhaXYVioWnS4kjhsPs=
=HZnU
-----END PGP SIGNATURE-----

Affects		Status	Importance	Assigned to	Milestone
	mozilla-thunderbird (Debian)	Fix Released	Unknown	debbugs #329664
	mozilla-thunderbird (Ubuntu)	Fix Released	High	Adam Conrad

Ubuntu
mozilla-thunderbird package

shell command execution

Bug Description

CVE References

Duplicates of this bug

Other bug subscribers

Remote bug watches

Ubuntumozilla-thunderbird package

shell command execution

Bug Description

CVE References

Duplicates of this bug

Other bug subscribers

Remote bug watches

Ubuntu
mozilla-thunderbird package