-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2012.0433
                          icedove security update
                                4 May 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           icedove
Publisher:         Debian
Operating System:  Debian GNU/Linux 6
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Cross-site Scripting            -- Remote with User Interaction
                   Provide Misleading Information  -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2012-0479 CVE-2012-0477 CVE-2012-0471
                   CVE-2012-0470 CVE-2012-0467 

Reference:         ASB-2012.0063
                   ESB-2012.0405
                   ESB-2012.0404

Original Bulletin: 
   http://www.debian.org/security/2012/dsa-2464

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2464-1                   security@debian.org
http://www.debian.org/security/                        Moritz Muehlenhoff
May 02, 2012                           http://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : icedove
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-0467 CVE-2012-0470 CVE-2012-0471 CVE-2012-0477 
                 CVE-2012-0479

Several vulnerabilities have been discovered in Icedove, an unbranded
version of the Thunderbird mail/news client.

CVE-2012-0467

   Bob Clary, Christian Holler, Brian Hackett, Bobby Holley, Gary
   Kwong, Hilary Hall, Honza Bambas, Jesse Ruderman, Julian Seward,
   and Olli Pettay discovered memory corruption bugs, which may lead
   to the execution of arbitrary code.

CVE-2012-0470

   Atte Kettunen discovered that a memory corruption bug in
   gfxImageSurface may lead to the execution of arbitrary code.

CVE-2012-0471

   Anne van Kesteren discovered that incorrect multibyte octet
   decoding may lead to cross-site scripting.

CVE-2012-0477

   Masato Kinugawa discovered that incorrect encoding of
   Korean and Chinese character sets may lead to cross-site scripting.

CVE-2012-0479

   Jeroen van der Gun discovered a spoofing vulnerability in the
   presentation of Atom and RSS feeds over HTTPS.

For the stable distribution (squeeze), this problem has been fixed in
version 3.0.11-1+squeeze9.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your icedove packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAk+hWBsACgkQXm3vHE4uylpUpgCePI+7qkAjfvp/Ml8PKfatTwDL
ih4AmQFWRb0ykHkec0yI5AgH0V54TfVS
=tNcW
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBT6M1XO4yVqjM2NGpAQKiFg/+Od+qxkp+QRvVrmgg4CUyIm6sa/YQ0TwL
K9AFvQF6BUxWT1cYJxE4zPND2LWYf7tTFAC/0J75fqDXNDLjQPCIj6LAqE9x0WAt
2FOgZ6gtCW2RkEkB2uwrTbdH1OsFo0haXDnXl3w2rYpa1DsOxn8rG2V8MlU83bx0
j4EOjX3NBQXlz6DZtzIUn8gckoh93sO9KD1A4m1JO2aRWvj0wyXdtxmexw0bvN5v
Ig/AbjH1PfDMtvr8CwVaxdjoiFgCEG65p28oKxx6ngbRcLJIsQH5cPQA2Tlyeqm/
JDJHm6Le0oYwX7PiY1HVKAQ/wVGpZC5VCwJHNr2j6iKL7ZbB6gJiyeX8wXPjI9i1
mWaAcGHikHazusOaihqM3bJ/U8s6DwNIkNmvxVculgu+t5JbCC0yhMnh+aTB8Chc
sPdpNCd5U/oh1zEm4WURWkxh4gSgBcrhOYlVV+brOUBeYfa/gVZNWNN0rxCyZHp2
F1g7uWgR8GoxnIjV+ka6jpxZZTGIhfEqh1W3GY9yuALmoceKrGqcTGCcFY4t1jm5
Y40N0H552T5lIUSF88WxWZ3T6RKKLeS8BzYd7h+i+n0xRpJ2NU7bbXfLvViVlgKv
ucMIsHdIO4mW9b07ddslmnPRnPpNz3QpC3MTR7NaaWuFjHyPL68m1ImqzIk9jb5k
BZqtcxX4VzY=
=Kecx
-----END PGP SIGNATURE-----