Oval Definition:oval:com.redhat.rhsa:def:20080547
Revision Date:2008-07-02Version:638
Title:RHSA-2008:0547: seamonkey security update (Critical)
Description:SeaMonkey is an open source Web browser, advanced email and newsgroup client, IRC chat client, and HTML editor.

  • Multiple flaws were found in the processing of malformed JavaScript content. A web page containing such malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-2801, CVE-2008-2802, CVE-2008-2803)

  • Several flaws were found in the processing of malformed web content. A web page containing malicious content could cause SeaMonkey to crash or, potentially, execute arbitrary code as the user running SeaMonkey. (CVE-2008-2798, CVE-2008-2799, CVE-2008-2811)

  • Several flaws were found in the way malformed web content was displayed. A web page containing specially-crafted content could potentially trick a SeaMonkey user into surrendering sensitive information. (CVE-2008-2800)

  • Two local file disclosure flaws were found in SeaMonkey. A web page containing malicious content could cause SeaMonkey to reveal the contents of a local file to a remote attacker. (CVE-2008-2805, CVE-2008-2810)

  • A flaw was found in the way a malformed .properties file was processed by SeaMonkey. A malicious extension could read uninitialized memory, possibly leaking sensitive data to the extension. (CVE-2008-2807)

  • A flaw was found in the way SeaMonkey escaped a listing of local file names. If a user could be tricked into listing a local directory containing malicious file names, arbitrary JavaScript could be run with the permissions of the user running SeaMonkey. (CVE-2008-2808)

  • A flaw was found in the way SeaMonkey displayed information about self-signed certificates. It was possible for a self-signed certificate to contain multiple alternate name entries, which were not all displayed to the user, allowing them to mistakenly extend trust to an unknown site. (CVE-2008-2809)

    All SeaMonkey users should upgrade to these updated packages, which contain backported patches to resolve these issues.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2008-2798
    CVE-2008-2799
    CVE-2008-2800
    CVE-2008-2801
    CVE-2008-2802
    CVE-2008-2803
    CVE-2008-2805
    CVE-2008-2807
    CVE-2008-2808
    CVE-2008-2809
    CVE-2008-2810
    CVE-2008-2811
    RHSA-2008:0547
    RHSA-2008:0547-01
    RHSA-2008:0547-01
    Platform(s):Red Hat Enterprise Linux 3
    Red Hat Enterprise Linux 4
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 3 is installed
  • AND
  • seamonkey-dom-inspector is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-dom-inspector is signed with Red Hat master key
  • seamonkey-js-debugger is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-js-debugger is signed with Red Hat master key
  • seamonkey-devel is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-devel is signed with Red Hat master key
  • seamonkey-chat is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-chat is signed with Red Hat master key
  • seamonkey-nspr is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-nspr is signed with Red Hat master key
  • seamonkey-nss-devel is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-nss-devel is signed with Red Hat master key
  • seamonkey-nspr-devel is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-nspr-devel is signed with Red Hat master key
  • seamonkey is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey is signed with Red Hat master key
  • seamonkey-mail is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-mail is signed with Red Hat master key
  • seamonkey-nss is earlier than 0:1.0.9-0.20.el3
  • AND seamonkey-nss is signed with Red Hat master key
  • OR Package Information
  • Red Hat Enterprise Linux 4 is installed
  • AND
  • seamonkey-chat is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-chat is signed with Red Hat master key
  • seamonkey-dom-inspector is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-dom-inspector is signed with Red Hat master key
  • seamonkey-mail is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-mail is signed with Red Hat master key
  • seamonkey is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey is signed with Red Hat master key
  • seamonkey-js-debugger is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-js-debugger is signed with Red Hat master key
  • seamonkey-devel is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-devel is signed with Red Hat master key
  • Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 4 is installed
  • AND
  • seamonkey is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey is signed with Red Hat redhatrelease2 key
  • seamonkey-chat is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-chat is signed with Red Hat redhatrelease2 key
  • seamonkey-devel is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-devel is signed with Red Hat redhatrelease2 key
  • seamonkey-dom-inspector is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-dom-inspector is signed with Red Hat redhatrelease2 key
  • seamonkey-js-debugger is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-js-debugger is signed with Red Hat redhatrelease2 key
  • seamonkey-mail is earlier than 0:1.0.9-16.3.el4_6
  • AND seamonkey-mail is signed with Red Hat redhatrelease2 key
  • BACK