Debian DSA-2317-1 : icedove - several vulnerabilities

critical Nessus プラグイン ID 56395

言語 :

New! Vulnerability Priority Rating (VPR)

Tenable では、すべての脆弱性に対して動的な VPR が計算されます。VPR は脆弱性の情報を、脅威インテリジェンスや機械学習アルゴリズムと組み合わせて、攻撃時に最も悪用される可能性の高い脆弱性を予測します。詳細は、「VPR とは何で、CVSS とはどう違うのか」を参照してください。

VPR スコア : 5.9

概要

The remote Debian host is missing a security-related update.

説明

- CVE-2011-2372 Mariusz Mlynski discovered that websites could open a download dialog -- which has 'open' as the default action --, while a user presses the ENTER key.

- CVE-2011-2995 Benjamin Smedberg, Bob Clary and Jesse Ruderman discovered crashes in the rendering engine, which could lead to the execution of arbitrary code.

- CVE-2011-2998 Mark Kaplan discovered an integer underflow in the JavaScript engine, which could lead to the execution of arbitrary code.

- CVE-2011-2999 Boris Zbarsky discovered that incorrect handling of the window.location object could lead to bypasses of the same-origin policy.

- CVE-2011-3000 Ian Graham discovered that multiple Location headers might lead to CRLF injection.

As indicated in the Lenny (oldstable) release notes, security support for the Icedove packages in the oldstable needed to be stopped before the end of the regular Lenny security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a different mail client.

ソリューション

Upgrade the icedove packages.

For the stable distribution (squeeze), this problem has been fixed in version 3.0.11-1+squeeze5.

プラグインの詳細

深刻度: Critical

ID: 56395

ファイル名: debian_DSA-2317.nasl

バージョン: 1.17

タイプ: local

エージェント: unix

ファミリー: Debian Local Security Checks

公開日: 2011/10/6

更新日: 2021/1/11

依存関係: ssh_get_info.nasl

リスク情報

リスクファクター: Critical

VPR スコア: 5.9

CVSS v2.0

Base Score: 10

Temporal Score: 7.4

ベクトル: AV:N/AC:L/Au:N/C:C/I:C/A:C

現状ベクトル: E:U/RL:OF/RC:C

脆弱性の情報

CPE: p-cpe:/a:debian:debian_linux:icedove, cpe:/o:debian:debian_linux:6.0

必要な KB アイテム: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

エクスプロイトの容易さ: No known exploits are available

パッチ公開日: 2011/10/5

参照情報

CVE: CVE-2011-2372, CVE-2011-2995, CVE-2011-2998, CVE-2011-2999, CVE-2011-3000

BID: 49809, 49810, 49811, 49848, 49849

DSA: 2317