Icedove/Pythin-Django Security Updates for Debian

Posted by Philipp Esselbach on: 08/15/2012 09:07 AM [ Print | 0 comment(s) ]

The following security updates has been released for Debian GNU/Linux: [SECURITY] [DSA 2529-1] python-django security update and [SECURITY] [DSA 2528-1] icedove security update

[SECURITY] [DSA 2529-1] python-django security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2529-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
August 14, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : python-django
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-3442 CVE-2012-3443 CVE-2012-3444
Debian Bug : 683364

Jeroen Dekkers and others reported several vulnerabilities in Django,
a Python Web framework. The Common Vulnerabilities and Exposures
project defines the following issues:

CVE-2012-3442

Two functions do not validate the scheme of a redirect target,
which might allow remote attackers to conduct cross-site scripting
(XSS) attacks via a data: URL.

CVE-2012-3443

The ImageField class completely decompresses image data during image
validation, which allows remote attackers to cause a denial of service
(memory consumption) by uploading an image file.

CVE-2012-3444

The get_image_dimensions function in the image-handling functionality
uses a constant chunk size in all attempts to determine dimensions,
which allows remote attackers to cause a denial of service (process
or thread consumption) via a large TIFF image.

For the stable distribution (squeeze), this problem has been fixed in
version 1.2.3-3+squeeze3.

For the unstable distribution (sid), this problem has been fixed in
version 1.4.1-1.

We recommend that you upgrade your python-django packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

[SECURITY] [DSA 2528-1] icedove security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2528-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
August 14, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : icedove
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-1948 CVE-2012-1950 CVE-2012-1954 CVE-2012-1967

Several vulnerabilities were discovered in Icedove, Debian's version
of the Mozilla Thunderbird mail and news client.

CVE-2012-1948
Multiple unspecified vulnerabilities in the browser engine
were fixed.

CVE-2012-1950
The underlying browser engine allows address bar spoofing
through drag-and-drop.

CVE-2012-1954
A use-after-free vulnerability in the nsDocument::AdoptNode
function allows remote attackers to cause a denial of service
(heap memory corruption) or possibly execute arbitrary code.

CVE-2012-1967
An error in the implementation of the Javascript sandbox
allows execution of Javascript code with improper privileges
using javascript: URLs.

For the stable distribution (squeeze), these problems have been fixed
in version 3.0.11-1+squeeze12.

For the testing distribution (wheezy) and the unstable distribution
(sid), these problems have been fixed in version 10.0.6-1.

We recommend that you upgrade your icedove packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/