Closed Bug 284880 Opened 20 years ago Closed 19 years ago

Incorrect permissions for files in myspell directory

Categories

(Thunderbird :: Security, defect)

Product:
Thunderbird
Component:
Security
Platform:
x86
Linux
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED WORKSFORME

People

(Reporter: john, Assigned: mscott)

Details

(Whiteboard: [sg:needinfo]) 

User-Agent:       Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.2) Gecko/20040820 Debian/1.7.2-4
Build Identifier: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.2) Gecko/20040820 Debian/1.7.2-4

Just installed en-US spelling dictonaries from your site in Greece on Linux. The
default permissions on the libraries in /usr/lib/mozilla/components/myspell are
world writable.

Reproducible: Always
What did you download specifically (and from what URL)?  The files in en-US.xpi
 from 
here: http://www.mozilla.org/products/thunderbird/dictionaries.html did not have
world-writable permissions.

Also, there should be no libraries in components/myspell, only .aff and .dic files.

What is your umask?
Component: Installer → Security
Whiteboard: [sg:needinfo]
Summary: Big security issue-anyone on the planet can add a worm/virus to the dictionary file → Incorrect permissions for files in myspell directory
WFM based on comment 1 and lack of response from reporter.
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.