U radu programskog paketa SeaMonkey uočeno je više sigurnosnih propusta koje udaljeni napadač može iskoristiti za neovlašteni pristup sustavu, pristup osjetljivim informacijama, izmjenu podataka te proizvoljno izvršavanje programskog koda.
Problemi sigurnosti paketa SeaMonkey se javljaju zbog cjelobrojnog prepisivanja u komponenti "Array.reduceRight()", XSS (eng. Cross-site scripting) ranjivosti, korupcije memorije u "multipart/x-mixed-replace" komponenti, itd.
Posljedica:
Udaljeni napadač navedene ranjivosti može iskoristiti za proizvoljno izvršavanje programskog koda te neovlašteni pristup sustavu s mogućnošću pristupa osjetljivim informacijama i njihove izmjene.
Rješenje:
Rješenje problema sigurnosti je korištenje dostupnih programskih zakrpa.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[slackware-security] seamonkey (SSA:2011-195-01)
New seamonkey packages are available for Slackware 13.37, and -current to
fix security issues.
Here are the details from the Slackware 13.37 ChangeLog:
+--------------------------+
patches/packages/seamonkey-2.2-i486-1_slack13.37.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/announce/
(* Security fix *)
patches/packages/seamonkey-solibs-2.2-i486-1_slack13.37.txz: Upgraded.
This update contains security fixes and improvements.
For more information, see:
http://www.mozilla.org/security/announce/
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/seamonkey-2.2-i486-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/seamonkey-solibs-2.2-i486-1_slack13.37.txz
Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/seamonkey-2.2-x86_64-1_slack13.37.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/seamonkey-solibs-2.2-x86_64-1_slack13.37.txz
Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/seamonkey-solibs-2.2-i486-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/seamonkey-2.2-i486-1.txz
Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/l/seamonkey-solibs-2.2-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/seamonkey-2.2-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 13.37 package:
b96aff564252e24662cd833df957587c seamonkey-2.2-i486-1_slack13.37.txz
e5aca9eec859b12b97047d87e80d8d72 seamonkey-solibs-2.2-i486-1_slack13.37.txz
Slackware x86_64 13.37 package:
49178faed12f0f3a190ad342021bc87d seamonkey-2.2-x86_64-1_slack13.37.txz
403b14137c521f8d385d11f252eaa100 seamonkey-solibs-2.2-x86_64-1_slack13.37.txz
Slackware -current package:
fc1987372842b610cc7f5cb0f280b65f l/seamonkey-solibs-2.2-i486-1.txz
71e14c6f70f1869a044021e4f2a03768 xap/seamonkey-2.2-i486-1.txz
Slackware x86_64 -current package:
a2d6bafed1cd6ee6c1fd3841df4b7ab9 l/seamonkey-solibs-2.2-x86_64-1.txz
7a4fe27ad0a5498cd87d43c61609cc83 xap/seamonkey-2.2-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the packages as root:
# upgradepkg seamonkey-2.2-i486-1_slack13.37.txz
seamonkey-solibs-2.2-i486-1_slack13.37.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iEYEARECAAYFAk4fgl4ACgkQakRjwEAQIjP4nwCfeQHkMcu6Gdc0lorKZx/VOVkN
Ly8An1VdR1zB5mXsY3WpR8XiDXZ/Os5O
=Ks5Z
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke