-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2008-1535 2008-02-13 04:18:18 --------------------------------------------------------------------------------
Name : blam Product : Fedora 8 Version : 1.8.3 Release : 13.fc8 URL : http://www.cmartin.tk/blam.html Summary : An RSS/RDF feed reader Description : Blam is a tool that helps you keep track of the growing number of news feeds distributed as RSS. Blam lets you subscribe to any number of feeds and provides an easy to use and clean interface to stay up to date -------------------------------------------------------------------------------- Update Information: Mozilla Firefox is an open source Web browser. Several flaws were found in the way Firefox processed certain malformed web content. A webpage containing malicious content could cause Firefox to crash, or potentially execute arbitrary code as the user running Firefox. (CVE-2008-0412, CVE-2008-0413, CVE-2008-0415, CVE-2008-0419) Several flaws were found in the way Firefox displayed malformed web content. A webpage containing specially-crafted content could trick a user into surrendering sensitive information. (CVE-2008-0591, CVE-2008-0593) A flaw was found in the way Firefox stored password data. If a user saves login information for a malicious website, it could be possible to corrupt the password database, preventing the user from properly accessing saved password data. (CVE-2008-0417) A flaw was found in the way Firefox handles certain chrome URLs. If a user has certain extensions installed, it could allow a malicious website to steal sensitive session data. Note: this flaw does not affect a default installation of Firefox. (CVE-2008-0418) A flaw was found in the way Firefox saves certain text files. If a website offers a file of type "plain/text", rather than "text/plain", Firefox will not show future "text/plain" content to the user in the browser, forcing them to save those files locally to view the content. (CVE-2008-0592) Users of firefox are advised to upgrade to these updated packages, which contain updated packages to resolve these issues. -------------------------------------------------------------------------------- ChangeLog: * Fri Feb 8 2008 Christopher Aillon <[EMAIL PROTECTED]> - 1.8.3-13 - Rebuild against newer gecko * Tue Nov 27 2007 Christopher Aillon <[EMAIL PROTECTED]> - 1.8.3-12 - Rebuild against newer gecko * Thu Nov 22 2007 Peter Gordon <[EMAIL PROTECTED]> - 1.8.3-11 - Fix CVE-2005-4790 (bug 252294). * Tue Nov 13 2007 Peter Gordon <[EMAIL PROTECTED]> - 1.8.3-10 - Rebuild for new Gecko (Firefox 2.0.0.9). -------------------------------------------------------------------------------- References: [ 1 ] Bug #431732 - CVE-2008-0412 Mozilla layout engine crashes https://bugzilla.redhat.com/show_bug.cgi?id=431732 [ 2 ] Bug #431733 - CVE-2008-0413 Mozilla javascript engine crashes https://bugzilla.redhat.com/show_bug.cgi?id=431733 [ 3 ] Bug #432040 - CVE-2008-0414 mozilla: multiple file input focus stealing vulnerabilities https://bugzilla.redhat.com/show_bug.cgi?id=432040 [ 4 ] Bug #431739 - CVE-2008-0415 Mozilla arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=431739 [ 5 ] Bug #431742 - CVE-2008-0417 Mozilla arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=431742 [ 6 ] Bug #431748 - CVE-2008-0418 Mozilla chrome: directory traversal https://bugzilla.redhat.com/show_bug.cgi?id=431748 [ 7 ] Bug #431749 - CVE-2008-0419 Mozilla arbitrary code execution https://bugzilla.redhat.com/show_bug.cgi?id=431749 [ 8 ] Bug #431751 - CVE-2008-0591 Mozilla information disclosure flaw https://bugzilla.redhat.com/show_bug.cgi?id=431751 [ 9 ] Bug #431752 - CVE-2008-0592 Mozilla text file mishandling https://bugzilla.redhat.com/show_bug.cgi?id=431752 [ 10 ] Bug #431756 - CVE-2008-0593 Mozilla URL token stealing flaw https://bugzilla.redhat.com/show_bug.cgi?id=431756 [ 11 ] Bug #432036 - CVE-2008-0594 mozilla: web forgery warning may not be displayed https://bugzilla.redhat.com/show_bug.cgi?id=432036 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update blam' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-announce