This is a multi-part message in MIME format...



------------=_1138231313-28203-115





-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



 _______________________________________________________________________

 

 Mandriva Linux Security Advisory                         MDKSA-2006:021

 http://www.mandriva.com/security/

 _______________________________________________________________________

 

 Package : mozilla-thunderbird

 Date    : January 25, 2006

 Affected: 2006.0

 _______________________________________________________________________

 

 Problem Description:

 

 GUI display truncation vulnerability in Mozilla Thunderbird 1.0.2, 1.0.6, 

 and 1.0.7 allows user-complicit attackers to execute arbitrary code via an 

 attachment with a filename containing a large number of spaces ending with 

 a dangerous extension that is not displayed by Thunderbird, along with an 

 inconsistent Content-Type header, which could be used to trick a user into 

 downloading dangerous content by dragging or saving the attachment.

 

 The updated packages have been patched to correct this problem.

 _______________________________________________________________________



 References:

 

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0236

 _______________________________________________________________________

 

 Updated Packages:

 

 Mandriva Linux 2006.0:

 ec5571737dd8a0908f6532d657ccc378 
 2006.0/RPMS/mozilla-thunderbird-1.0.6-7.3.20060mdk.i586.rpm

 6ad6aa5666f6ba499c3e78a9e24f4917 
 2006.0/RPMS/mozilla-thunderbird-enigmail-1.0.6-7.3.20060mdk.i586.rpm

 a89fceffe0e0429c634b0b76120ee36a 
 2006.0/RPMS/mozilla-thunderbird-enigmime-1.0.6-7.3.20060mdk.i586.rpm

 8babd434a3fe12a7134239ca36658743 
 2006.0/SRPMS/mozilla-thunderbird-1.0.6-7.3.20060mdk.src.rpm



 Mandriva Linux 2006.0/X86_64:

 5df5db7c2e45cf30d3d5f0209a7b0cd8 
 x86_64/2006.0/RPMS/mozilla-thunderbird-1.0.6-7.3.20060mdk.x86_64.rpm

 58595fbd0a66345df85e4e586ee2bbd8 
 x86_64/2006.0/RPMS/mozilla-thunderbird-enigmail-1.0.6-7.3.20060mdk.x86_64.rpm

 351d08e5ca2c990fd6496f857b2b1fb0 
 x86_64/2006.0/RPMS/mozilla-thunderbird-enigmime-1.0.6-7.3.20060mdk.x86_64.rpm

 8babd434a3fe12a7134239ca36658743 
 x86_64/2006.0/SRPMS/mozilla-thunderbird-1.0.6-7.3.20060mdk.src.rpm

 _______________________________________________________________________



 To upgrade automatically use MandrivaUpdate or urpmi.  The verification

 of md5 checksums and GPG signatures is performed automatically for you.



 All packages are signed by Mandriva for security.  You can obtain the

 GPG public key of the Mandriva Security Team by executing:



  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98



 You can view other update advisories for Mandriva Linux at:



  http://www.mandriva.com/security/advisories



 If you want to report vulnerabilities, please contact



  security_(at)_mandriva.com

 _______________________________________________________________________



 Type Bits/KeyID     Date       User ID

 pub  1024D/22458A98 2000-07-10 Mandriva Security Team

  <security*mandriva.com>

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.2.4 (GNU/Linux)



iD8DBQFD19mcmqjQ0CJFipgRAomfAJ9Sc31DJhW3p3Uz8Hkn6IpbsyorkQCgxj0/

i4dbanmhBAKfdTfe1OYTJfo=

=Apkn

-----END PGP SIGNATURE-----





------------=_1138231313-28203-115

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit



To unsubscribe, send a email to sympa@mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva? 

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________



------------=_1138231313-28203-115--