Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

2.0.22 fixes several security issues

Related Vulnerabilities: CVE-2009-1841   CVE-2009-1838   CVE-2009-1836   CVE-2009-1832   CVE-2009-1831   CVE-2009-1307   CVE-2009-1303   CVE-2009-1302   CVE-2009-0652   CVE-2009-0040   CVE-2009-0776   CVE-2009-0771   CVE-2009-0352   CVE-2009-0353  

Source

Debian Bug report logs - #535124
2.0.22 fixes several security issues

version graph

Package: icedove; Maintainer for icedove is Carsten Schoenert <c.schoenert@t-online.de>; Source for icedove is src:thunderbird (PTS, buildd, popcon).

Reported by: Guido Günther <agx@sigxcpu.org>

Date: Mon, 29 Jun 2009 21:33:01 UTC

Severity: grave

Tags: security

Fixed in versions icedove/2.0.0.22-0lenny1, icedove/3.0.4-1, icedove/2.0.0.22-1

Done: Alexander Sack <asac@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to debian-bugs-dist@lists.debian.org, Debian Security Team <team@security.debian.org>, Debian Testing Security Team <secure-testing-team@lists.alioth.debian.org>, Ubuntu Mozilla Team <ubuntu-mozillateam@lists.ubuntu.com>:
Bug#535124; Package icedove. (Mon, 29 Jun 2009 21:33:04 GMT) (full text, mbox, link).

Acknowledgement sent to Guido Günther <agx@sigxcpu.org>:
New Bug report received and forwarded. Copy sent to Debian Security Team <team@security.debian.org>, Debian Testing Security Team <secure-testing-team@lists.alioth.debian.org>, Ubuntu Mozilla Team <ubuntu-mozillateam@lists.ubuntu.com>. (Mon, 29 Jun 2009 21:33:04 GMT) (full text, mbox, link).

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: 2.0.22 fixes several security issues
Date: Mon, 29 Jun 2009 23:32:11 +0200
Package: icedove
Severity: grave
Tags: security

Hi,
according to 

http://www.mozilla.org/security/known-vulnerabilities/thunderbird20.html#thunderbird2.0.0.22

2.0.20, 2.0.21 and 2.0.22 fix several security issues in thunderbird.
Lenny ships 2.0.19 so it looks vulnerable.
Cheers,
 -- Guido

Reply sent to Alexander Sack <asac@debian.org>:
You have taken responsibility. (Wed, 01 Jul 2009 13:18:03 GMT) (full text, mbox, link).

Notification sent to Guido Günther <agx@sigxcpu.org>:
Bug acknowledged by developer. (Wed, 01 Jul 2009 13:18:03 GMT) (full text, mbox, link).

Message #10 received at 535124-close@bugs.debian.org (full text, mbox, reply):

From: Alexander Sack <asac@debian.org>
To: 535124-close@bugs.debian.org
Subject: Bug#535124: fixed in icedove 2.0.0.22-1
Date: Wed, 01 Jul 2009 13:02:24 +0000
Source: icedove
Source-Version: 2.0.0.22-1

We believe that the bug you reported is fixed in the latest version of
icedove, which is due to be installed in the Debian FTP archive:

icedove-dbg_2.0.0.22-1_amd64.deb
  to pool/main/i/icedove/icedove-dbg_2.0.0.22-1_amd64.deb
icedove-dev_2.0.0.22-1_amd64.deb
  to pool/main/i/icedove/icedove-dev_2.0.0.22-1_amd64.deb
icedove-gnome-support_2.0.0.22-1_amd64.deb
  to pool/main/i/icedove/icedove-gnome-support_2.0.0.22-1_amd64.deb
icedove_2.0.0.22-1.diff.gz
  to pool/main/i/icedove/icedove_2.0.0.22-1.diff.gz
icedove_2.0.0.22-1.dsc
  to pool/main/i/icedove/icedove_2.0.0.22-1.dsc
icedove_2.0.0.22-1_amd64.deb
  to pool/main/i/icedove/icedove_2.0.0.22-1_amd64.deb
icedove_2.0.0.22.orig.tar.gz
  to pool/main/i/icedove/icedove_2.0.0.22.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 535124@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated icedove package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 01 Jul 2009 12:18:03 +0200
Source: icedove
Binary: icedove icedove-gnome-support icedove-dbg icedove-dev
Architecture: source amd64
Version: 2.0.0.22-1
Distribution: unstable
Urgency: low
Maintainer: Ubuntu Mozilla Team <ubuntu-mozillateam@lists.ubuntu.com>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 icedove    - free/unbranded thunderbird mail/news/rss clone
 icedove-dbg - Debug Symbols for Icedove
 icedove-dev - Development files for Icedove
 icedove-gnome-support - Support for Gnome in Icedove
Closes: 535124
Changes: 
 icedove (2.0.0.22-1) unstable; urgency=low
 .
   * New upstream security/stability update (v2.0.0.21/v2.0.0.22) (Closes: 535124)
     * MFSA 2009-33: Crash viewing multipart/alternative message with text/enhanced part
     * MFSA 2009-32 aka CVE-2009-1841: JavaScript chrome privilege escalation
     * MFSA 2009-29 aka CVE-2009-1838: Arbitrary code execution using event listeners
       attached to an element whose owner document is null
     * MFSA 2009-27 aka CVE-2009-1836: SSL tampering via non-200 responses to proxy
       CONNECT requests
     * MFSA 2009-24 aka CVE-2009-1832+CVE-2009-1831: Crashes with evidence of memory
       corruption (rv:1.9.0.11)
     * MFSA 2009-17 aka CVE-2009-1307: Same-origin violations when Adobe Flash loaded
       via view-source: scheme
     * MFSA 2009-14 aka CVE-2009-1303+CVE-2009-1302: Crashes with evidence of memory
       corruption (rv:1.9.0.9)
     * MFSA 2009-15 aka CVE-2009-0652: URL spoofing with box drawing character
     * MFSA 2009-10 aka CVE-2009-0040: Upgrade PNG library to fix memory safety hazards
     * MFSA 2009-09 aka CVE-2009-0776: XML data theft via RDFXMLDataSource and cross-domain
       redirect
     * MFSA 2009-07 aka CVE-2009-0771,-0772,-0773,-0774: Crashes with evidence of memory
       corruption (rv:1.9.0.7)
     * MFSA 2009-01 aka CVE-2009-0352,CVE-2009-0353 Crashes with evidence of memory
       corruption (rv:1.9.0.6)
   * adjust patches to changed codebase
     - update debian/patches/ubuntu-mail-app-xre-name
Checksums-Sha1: 
 398da416eacbf016c236537c68b70fe7760836c7 2340 icedove_2.0.0.22-1.dsc
 69906157f63eb834f9448113935a54cdd7c57b5a 36965969 icedove_2.0.0.22.orig.tar.gz
 01929d25780e89ff7be061780139c4e65a5086da 119647 icedove_2.0.0.22-1.diff.gz
 3c369a22c26902aef61966ee11165784e50193ba 12322482 icedove_2.0.0.22-1_amd64.deb
 22e4f0f550be6bdeeedd7bfe7ed7b7b0371c1586 58586 icedove-gnome-support_2.0.0.22-1_amd64.deb
 2043893fc1e3aafb8e7f48da3abc6549bb01df55 57821440 icedove-dbg_2.0.0.22-1_amd64.deb
 61ac3071f4a3ec9b963c47701e05362e72e8f5c8 3918212 icedove-dev_2.0.0.22-1_amd64.deb
Checksums-Sha256: 
 0bc9971e58a439c63bea62bf1a3a51ae58f6ef83d50500a030ef36559f683d0c 2340 icedove_2.0.0.22-1.dsc
 a7807bee77140c93ef335c726609eebb4f35eaec0fc316e309e959dfecf11fa1 36965969 icedove_2.0.0.22.orig.tar.gz
 6534ec6afad82c254951542818157a9ddb0ec6bbec4cc4f772f21106d24b38ee 119647 icedove_2.0.0.22-1.diff.gz
 d3cf7639c660655add32b0f120a1c5bf9724730eb7e19bb4a4b7abca1f81c222 12322482 icedove_2.0.0.22-1_amd64.deb
 c265a06a449b3126f1c05a75a5d2f16acff1a5f2a6de71774a29d6d76a91f0d0 58586 icedove-gnome-support_2.0.0.22-1_amd64.deb
 67506d771998b1872803bc4c76376b68918aacacfd27246f6d9052080bed936e 57821440 icedove-dbg_2.0.0.22-1_amd64.deb
 a234e0af1c812ff7d896479956c76a5a27d8df91beb9cf2f1ebd3f2a19bee07f 3918212 icedove-dev_2.0.0.22-1_amd64.deb
Files: 
 cc10cb12e7c174d4c8a5c87698fcc78d 2340 mail optional icedove_2.0.0.22-1.dsc
 8e0ffafaece0680a42c0cb11ff34c64a 36965969 mail optional icedove_2.0.0.22.orig.tar.gz
 d37562ffa218b4cf1730a27fddd9857d 119647 mail optional icedove_2.0.0.22-1.diff.gz
 b36503cfc9345d9fea402c8b6f21e7df 12322482 mail optional icedove_2.0.0.22-1_amd64.deb
 69d09de772a749cf287f43b38a4762a0 58586 mail optional icedove-gnome-support_2.0.0.22-1_amd64.deb
 443811e9f4a8a010773660dccaf8bf9a 57821440 mail optional icedove-dbg_2.0.0.22-1_amd64.deb
 2db8c1314bf950d4cb347b4a28f775d3 3918212 mail optional icedove-dev_2.0.0.22-1_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQIcBAEBAgAGBQJKS1XdAAoJEKBE/gcUDGZkSrQP+gKpjWHUpJylsqKEeI89TaoA
mkJqHhL6J74A8dzfrKBbewAlaUdHLfxo5LzHrMytP+ef7+68evtLROKjZFi2cwLT
Tj+d4jU5OnqYO5bsi3DkfXJ8PkE/tLujgBsuB0TOyrzV1DO+Sn1rccR2AQQoCYBy
76VtmFa4SGEgMylzZPvDFTN/a1y0iFncLWBMq3bdmvXaj72eaASdeg2yKT2VMWet
hl8SagLSHcUDJNMWFUqXyNE69uxxmce4WcnaGGNv5mJwbw2GwD4WNUYisZXYJzt/
4Vl7KFE9dGmzFLlNouR8BOSgJgDI/QQYSSplxnT2je6HAZ+75Mm5wKLviXoSYQbc
upXKkQ5/12Nka9+1cdG0s7Vyvv6wadTmzU9fzip8BI26HHRS1SSH6+OvB7Ul24gh
3s/GNtPEqOQ/Q4gSv4FH5O9wE0maCcdlAD0/CU75CCD5LoBq+a2Pje5oByPsP/Fi
D/553YmY6hUXe3vgRE8VKCR9QPSwVI8yo/ywmJMOpYPrz37z2TpmqIauuSd5aPPl
1OupF0ePsUVFvJtE8cFW95tBfRGQb+SFAB89bkmOrSfeNBOajK92qAg4bKj+T/f+
PJUJZhMrUxc4H1wGPOtoSPSnDFOQZY4xjUiUImIpJELhfHhqoAOVZ9c5ajZrIpvK
3y0nWAoxJxtcUlLgF7UD
=e51i
-----END PGP SIGNATURE-----

Reply sent to Alexander Sack <asac@debian.org>:
You have taken responsibility. (Sun, 12 Jul 2009 20:06:06 GMT) (full text, mbox, link).

Notification sent to Guido Günther <agx@sigxcpu.org>:
Bug acknowledged by developer. (Sun, 12 Jul 2009 20:06:06 GMT) (full text, mbox, link).

Message #15 received at 535124-close@bugs.debian.org (full text, mbox, reply):

From: Alexander Sack <asac@debian.org>
To: 535124-close@bugs.debian.org
Subject: Bug#535124: fixed in icedove 2.0.0.22-0lenny1
Date: Sun, 12 Jul 2009 19:54:00 +0000
Source: icedove
Source-Version: 2.0.0.22-0lenny1

We believe that the bug you reported is fixed in the latest version of
icedove, which is due to be installed in the Debian FTP archive:

icedove-dbg_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_i386.deb
icedove-dev_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_i386.deb
icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
icedove_2.0.0.22-0lenny1.diff.gz
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1.diff.gz
icedove_2.0.0.22-0lenny1.dsc
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1.dsc
icedove_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 535124@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated icedove package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 05 Jul 2009 13:49:04 +0200
Source: icedove
Binary: icedove icedove-gnome-support icedove-dbg icedove-dev
Architecture: source i386
Version: 2.0.0.22-0lenny1
Distribution: stable-security
Urgency: low
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 icedove    - free/unbranded thunderbird mail/news/rss clone
 icedove-dbg - Debug Symbols for Icedove
 icedove-dev - Development files for Icedove
 icedove-gnome-support - Support for Gnome in Icedove
Closes: 535124
Changes: 
 icedove (2.0.0.22-0lenny1) stable-security; urgency=low
 .
   * New upstream security/stability update (v2.0.0.21/v2.0.0.22) (Closes: 535124)
     * MFSA 2009-33: Crash viewing multipart/alternative message with text/enhanced part
     * MFSA 2009-32 aka CVE-2009-1841: JavaScript chrome privilege escalation
     * MFSA 2009-29 aka CVE-2009-1838: Arbitrary code execution using event listeners
       attached to an element whose owner document is null
     * MFSA 2009-27 aka CVE-2009-1836: SSL tampering via non-200 responses to proxy
       CONNECT requests
     * MFSA 2009-24 aka CVE-2009-1832+CVE-2009-1831: Crashes with evidence of memory
       corruption (rv:1.9.0.11)
     * MFSA 2009-17 aka CVE-2009-1307: Same-origin violations when Adobe Flash loaded
       via view-source: scheme
     * MFSA 2009-14 aka CVE-2009-1303+CVE-2009-1302: Crashes with evidence of memory
       corruption (rv:1.9.0.9)
     * MFSA 2009-15 aka CVE-2009-0652: URL spoofing with box drawing character
     * MFSA 2009-10 aka CVE-2009-0040: Upgrade PNG library to fix memory safety hazards
     * MFSA 2009-09 aka CVE-2009-0776: XML data theft via RDFXMLDataSource and cross-domain
       redirect
     * MFSA 2009-07 aka CVE-2009-0771,-0772,-0773,-0774: Crashes with evidence of memory
       corruption (rv:1.9.0.7)
     * MFSA 2009-01 aka CVE-2009-0352,CVE-2009-0353 Crashes with evidence of memory
       corruption (rv:1.9.0.6)
   * adjust patches to changed codebase
     - update debian/patches/ubuntu-mail-app-xre-name
   * take back Maintainer: field in debian/control
Checksums-Sha1: 
 69fcfcc253a2dffe2b81517fc9e26b3397dec694 1667 icedove_2.0.0.22-0lenny1.dsc
 69906157f63eb834f9448113935a54cdd7c57b5a 36965969 icedove_2.0.0.22.orig.tar.gz
 f9bc63c0ee4dbab50922ed8092bc8526623dad99 118782 icedove_2.0.0.22-0lenny1.diff.gz
 22e74ac4f14d901c869042181b1f05253bb72732 10924508 icedove_2.0.0.22-0lenny1_i386.deb
 67f5af976de89479df153d06edebdd69027a6dd1 54082 icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 8e2a91dde150f489cf561534d6384d0c87e337b0 56523330 icedove-dbg_2.0.0.22-0lenny1_i386.deb
 13681c7f08d57e2e49e9be0d542ab16008bc57ed 3934604 icedove-dev_2.0.0.22-0lenny1_i386.deb
Checksums-Sha256: 
 7c4f2f074137d6b79d0c32f398a1ed6772812033c1116ce4e7d0decdd63ae7db 1667 icedove_2.0.0.22-0lenny1.dsc
 a7807bee77140c93ef335c726609eebb4f35eaec0fc316e309e959dfecf11fa1 36965969 icedove_2.0.0.22.orig.tar.gz
 2dc63c4c7892c5f1e90f079897280ca1e13c2a5a104003f2b634cdfc6a7bc210 118782 icedove_2.0.0.22-0lenny1.diff.gz
 2635be264a874a24a7ca4628c3029e52da93ae4c89147b1a0a561b30ae4b4cdb 10924508 icedove_2.0.0.22-0lenny1_i386.deb
 d5972e137dec4483d5fd2dcca5b12005341a53919a2f75372b3800ed4c5dedb5 54082 icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 eb8a3dd3d254cad1d3b22c2f35e1b69972b1ab10245d8afdcba1d11f703b4c59 56523330 icedove-dbg_2.0.0.22-0lenny1_i386.deb
 3da208aaf246deefab82be6b669e1de81cbdf1ede6471210e9205fdd5274dbd7 3934604 icedove-dev_2.0.0.22-0lenny1_i386.deb
Files: 
 e373157340de8a93d36e6210afe2f345 1667 mail optional icedove_2.0.0.22-0lenny1.dsc
 8e0ffafaece0680a42c0cb11ff34c64a 36965969 mail optional icedove_2.0.0.22.orig.tar.gz
 0f1d8098818180a72820438adfa79436 118782 mail optional icedove_2.0.0.22-0lenny1.diff.gz
 b4cf9766cac84f9d21defc2ea4e1d1bc 10924508 mail optional icedove_2.0.0.22-0lenny1_i386.deb
 86ac55697cfc6abc6a719be26c5fcb48 54082 mail optional icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 8f925c6cea9ec7e628e05a8079dd30ad 56523330 mail optional icedove-dbg_2.0.0.22-0lenny1_i386.deb
 336b57d8a95a52cffc2c07b5ed605c74 3934604 mail optional icedove-dev_2.0.0.22-0lenny1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpTXrEACgkQ62zWxYk/rQeCaQCglQG2ElCm5Tva83h6Pb4nZkos
uA4An0TghngCcjEfzMK7qoZBB6/5N7yw
=ZJ34
-----END PGP SIGNATURE-----

Reply sent to Alexander Sack <asac@debian.org>:
You have taken responsibility. (Fri, 04 Sep 2009 19:21:26 GMT) (full text, mbox, link).

Notification sent to Guido Günther <agx@sigxcpu.org>:
Bug acknowledged by developer. (Fri, 04 Sep 2009 19:21:27 GMT) (full text, mbox, link).

Message #20 received at 535124-close@bugs.debian.org (full text, mbox, reply):

From: Alexander Sack <asac@debian.org>
To: 535124-close@bugs.debian.org
Subject: Bug#535124: fixed in icedove 2.0.0.22-0lenny1
Date: Fri, 04 Sep 2009 18:32:04 +0000
Source: icedove
Source-Version: 2.0.0.22-0lenny1

We believe that the bug you reported is fixed in the latest version of
icedove, which is due to be installed in the Debian FTP archive:

icedove-dbg_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-dbg_2.0.0.22-0lenny1_i386.deb
icedove-dev_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-dev_2.0.0.22-0lenny1_i386.deb
icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
icedove_2.0.0.22-0lenny1.diff.gz
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1.diff.gz
icedove_2.0.0.22-0lenny1.dsc
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1.dsc
icedove_2.0.0.22-0lenny1_i386.deb
  to pool/main/i/icedove/icedove_2.0.0.22-0lenny1_i386.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 535124@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Alexander Sack <asac@debian.org> (supplier of updated icedove package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Sun, 05 Jul 2009 13:49:04 +0200
Source: icedove
Binary: icedove icedove-gnome-support icedove-dbg icedove-dev
Architecture: source i386
Version: 2.0.0.22-0lenny1
Distribution: stable-security
Urgency: low
Maintainer: Alexander Sack <asac@debian.org>
Changed-By: Alexander Sack <asac@debian.org>
Description: 
 icedove    - free/unbranded thunderbird mail/news/rss clone
 icedove-dbg - Debug Symbols for Icedove
 icedove-dev - Development files for Icedove
 icedove-gnome-support - Support for Gnome in Icedove
Closes: 535124
Changes: 
 icedove (2.0.0.22-0lenny1) stable-security; urgency=low
 .
   * New upstream security/stability update (v2.0.0.21/v2.0.0.22) (Closes: 535124)
     * MFSA 2009-33: Crash viewing multipart/alternative message with text/enhanced part
     * MFSA 2009-32 aka CVE-2009-1841: JavaScript chrome privilege escalation
     * MFSA 2009-29 aka CVE-2009-1838: Arbitrary code execution using event listeners
       attached to an element whose owner document is null
     * MFSA 2009-27 aka CVE-2009-1836: SSL tampering via non-200 responses to proxy
       CONNECT requests
     * MFSA 2009-24 aka CVE-2009-1832+CVE-2009-1831: Crashes with evidence of memory
       corruption (rv:1.9.0.11)
     * MFSA 2009-17 aka CVE-2009-1307: Same-origin violations when Adobe Flash loaded
       via view-source: scheme
     * MFSA 2009-14 aka CVE-2009-1303+CVE-2009-1302: Crashes with evidence of memory
       corruption (rv:1.9.0.9)
     * MFSA 2009-15 aka CVE-2009-0652: URL spoofing with box drawing character
     * MFSA 2009-10 aka CVE-2009-0040: Upgrade PNG library to fix memory safety hazards
     * MFSA 2009-09 aka CVE-2009-0776: XML data theft via RDFXMLDataSource and cross-domain
       redirect
     * MFSA 2009-07 aka CVE-2009-0771,-0772,-0773,-0774: Crashes with evidence of memory
       corruption (rv:1.9.0.7)
     * MFSA 2009-01 aka CVE-2009-0352,CVE-2009-0353 Crashes with evidence of memory
       corruption (rv:1.9.0.6)
   * adjust patches to changed codebase
     - update debian/patches/ubuntu-mail-app-xre-name
   * take back Maintainer: field in debian/control
Checksums-Sha1: 
 69fcfcc253a2dffe2b81517fc9e26b3397dec694 1667 icedove_2.0.0.22-0lenny1.dsc
 69906157f63eb834f9448113935a54cdd7c57b5a 36965969 icedove_2.0.0.22.orig.tar.gz
 f9bc63c0ee4dbab50922ed8092bc8526623dad99 118782 icedove_2.0.0.22-0lenny1.diff.gz
 22e74ac4f14d901c869042181b1f05253bb72732 10924508 icedove_2.0.0.22-0lenny1_i386.deb
 67f5af976de89479df153d06edebdd69027a6dd1 54082 icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 8e2a91dde150f489cf561534d6384d0c87e337b0 56523330 icedove-dbg_2.0.0.22-0lenny1_i386.deb
 13681c7f08d57e2e49e9be0d542ab16008bc57ed 3934604 icedove-dev_2.0.0.22-0lenny1_i386.deb
Checksums-Sha256: 
 7c4f2f074137d6b79d0c32f398a1ed6772812033c1116ce4e7d0decdd63ae7db 1667 icedove_2.0.0.22-0lenny1.dsc
 a7807bee77140c93ef335c726609eebb4f35eaec0fc316e309e959dfecf11fa1 36965969 icedove_2.0.0.22.orig.tar.gz
 2dc63c4c7892c5f1e90f079897280ca1e13c2a5a104003f2b634cdfc6a7bc210 118782 icedove_2.0.0.22-0lenny1.diff.gz
 2635be264a874a24a7ca4628c3029e52da93ae4c89147b1a0a561b30ae4b4cdb 10924508 icedove_2.0.0.22-0lenny1_i386.deb
 d5972e137dec4483d5fd2dcca5b12005341a53919a2f75372b3800ed4c5dedb5 54082 icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 eb8a3dd3d254cad1d3b22c2f35e1b69972b1ab10245d8afdcba1d11f703b4c59 56523330 icedove-dbg_2.0.0.22-0lenny1_i386.deb
 3da208aaf246deefab82be6b669e1de81cbdf1ede6471210e9205fdd5274dbd7 3934604 icedove-dev_2.0.0.22-0lenny1_i386.deb
Files: 
 e373157340de8a93d36e6210afe2f345 1667 mail optional icedove_2.0.0.22-0lenny1.dsc
 8e0ffafaece0680a42c0cb11ff34c64a 36965969 mail optional icedove_2.0.0.22.orig.tar.gz
 0f1d8098818180a72820438adfa79436 118782 mail optional icedove_2.0.0.22-0lenny1.diff.gz
 b4cf9766cac84f9d21defc2ea4e1d1bc 10924508 mail optional icedove_2.0.0.22-0lenny1_i386.deb
 86ac55697cfc6abc6a719be26c5fcb48 54082 mail optional icedove-gnome-support_2.0.0.22-0lenny1_i386.deb
 8f925c6cea9ec7e628e05a8079dd30ad 56523330 mail optional icedove-dbg_2.0.0.22-0lenny1_i386.deb
 336b57d8a95a52cffc2c07b5ed605c74 3934604 mail optional icedove-dev_2.0.0.22-0lenny1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpTXrEACgkQ62zWxYk/rQeCaQCglQG2ElCm5Tva83h6Pb4nZkos
uA4An0TghngCcjEfzMK7qoZBB6/5N7yw
=ZJ34
-----END PGP SIGNATURE-----

Bug Marked as fixed in versions icedove/3.0.4-1. Request was from Christoph Goehre <chris@sigxcpu.org> to control@bugs.debian.org. (Mon, 12 Apr 2010 16:24:03 GMT) (full text, mbox, link).

Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Tue, 11 May 2010 07:34:01 GMT) (full text, mbox, link).

Send a report that this bug log contains spam.

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Wed Jun 19 18:19:59 2019; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started