Detections
Analytics
Debian DSA-2025-1 : icedove - several vulnerabilities
critical Nessus Plugin ID 45397
Language:
Synopsis
The remote Debian host is missing a security-related update.Description
Several remote vulnerabilities have been discovered in the Icedove mail client, an unbranded version of the Thunderbird mail client. The Common Vulnerabilities and Exposures project identifies the following problems :- CVE-2009-2408 Dan Kaminsky and Moxie Marlinspike discovered that icedove does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate (MFSA 2009-42).
- CVE-2009-2404 Moxie Marlinspike reported a heap overflow vulnerability in the code that handles regular expressions in certificate names (MFSA 2009-43).
- CVE-2009-2463 monarch2020 discovered an integer overflow in a base64 decoding function (MFSA 2010-07).
- CVE-2009-3072 Josh Soref discovered a crash in the BinHex decoder (MFSA 2010-07).
- CVE-2009-3075 Carsten Book reported a crash in the JavaScript engine (MFSA 2010-07).
- CVE-2010-0163 Ludovic Hirlimann reported a crash indexing some messages with attachments, which could lead to the execution of arbitrary code (MFSA 2010-07).
Solution
Upgrade the icedove packages.For the stable distribution (lenny), these problems have been fixed in version 2.0.0.24-0lenny1.
Due to a problem with the archive system it is not possible to release all architectures. The missing architectures will be installed into the archive once they become available.
See Also
https://security-tracker.debian.org/tracker/CVE-2009-2408
https://security-tracker.debian.org/tracker/CVE-2009-2404
https://security-tracker.debian.org/tracker/CVE-2009-2463
https://security-tracker.debian.org/tracker/CVE-2009-3072
https://security-tracker.debian.org/tracker/CVE-2009-3075
Plugin Details
Severity: Critical
ID: 45397
File Name: debian_DSA-2025.nasl
Version: 1.19
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 4/1/2010
Updated: 1/4/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:icedove, cpe:/o:debian:debian_linux:5.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 3/31/2010
Reference Information
CVE: CVE-2009-2404, CVE-2009-2408, CVE-2009-2463, CVE-2009-3072, CVE-2009-3075, CVE-2010-0163