Red Hat Security Advisory

RHSA-2008:0978

firefox security update

Released 2008-11-13 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) devhelp-0.12-20.el5, devhelp-0.12-20.el5.i386, devhelp-0.12-20.el5.ia64 +41
Red Hat Enterprise Linux AS version 4 firefox-3.0.4-1.el4, firefox-3.0.4-1.el4.i386, firefox-3.0.4-1.el4.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) devhelp-0.12-20.el5, devhelp-0.12-20.el5.i386, firefox-3.0.4-1.el5 +9
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) devhelp-0.12-20.el5, devhelp-devel-0.12-20.el5, devhelp-devel-0.12-20.el5.i386 +10
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.4-1.el4, firefox-3.0.4-1.el4.i386, nss-3.12.1.1-3.el4 +3
Red Hat Enterprise Linux ES version 4 firefox-3.0.4-1.el4, firefox-3.0.4-1.el4.i386, firefox-3.0.4-1.el4.ia64 +6
Red Hat Enterprise Linux WS version 4 firefox-3.0.4-1.el4, firefox-3.0.4-1.el4.i386, firefox-3.0.4-1.el4.ia64 +6

Fixes 12 records

TI-2008-04768 CVE-2008-5014 · GHSA-8m88-6wvj-46c6

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird…

MEDIUM 52

jslock.cpp in Mozilla Firefox 3.x before 3.0.2, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly exec…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05865 Published 2008-11-13 Fixed CWE-20

TI-2008-00016 CVE-2008-0017 · GHSA-4386-5g32-qp3p

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4…

MEDIUM 50

The http-index-format MIME type parser (nsDirIndexParser) in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 does not check for an allocation failure, which allows remote attackers…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07677 Published 2008-11-13 Fixed CWE-119

TI-2008-04805 CVE-2008-5052 · GHSA-4fmr-pw88-x9j3

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before…

MEDIUM 49

The AppendAttributeValue function in the JavaScript engine in Mozilla Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (cr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03448 Published 2008-11-13 Fixed CWE-399

TI-2008-04772 CVE-2008-5018 · GHSA-ww2m-xjhr-w96h

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18…

MEDIUM 49

The JavaScript engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via ve…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-399

TI-2008-04771 CVE-2008-5017 · GHSA-h983-53hw-mp7w

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x…

MEDIUM 49

Integer overflow in xpcom/io/nsEscape.cpp in the browser engine in Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers t…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03839 Published 2008-11-13 Fixed CWE-189

TI-2008-04774 CVE-2008-5021 · GHSA-7qf3-8pfp-6qg9

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x…

MEDIUM 46

nsFrameManager in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) and possibly execute…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03633 Published 2008-11-13 Fixed CWE-362

TI-2008-04777 CVE-2008-5024 · GHSA-r9x5-wf23-5hh7

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before…

LOW 39

Mozilla Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 do not properly escape quote characters used for XML processing, which allows remote attacke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03641 Published 2008-11-13 Fixed CWE-91

TI-2008-04776 CVE-2008-5023 · GHSA-w4jm-xq46-3m5g

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13…

LOW 39

Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the protection mechanism for codebase principals and execute arbitrary script via the -moz-binding…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03261 Published 2008-11-13 Fixed CWE-20

TI-2008-04775 CVE-2008-5022 · GHSA-49p4-3jx5-xgmj

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox…

LOW 38

The nsXMLHttpRequest::NotifyEventListeners method in Firefox 3.x before 3.0.4, Firefox 2.x before 2.0.0.18, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to bypass the same-orig…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03029 Published 2008-11-13 Fixed CWE-287

TI-2008-04769 CVE-2008-5015 · GHSA-w7p9-j7cw-wfpm

Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is…

LOW 28

Mozilla Firefox 3.x before 3.0.4 assigns chrome privileges to a file: URI when it is accessed in the same tab from a chrome or privileged about: page, which makes it easier for user-assisted attackers to execute arbitrar…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.02215 Published 2008-11-13 Fixed CWE-94

TI-2008-04770 CVE-2008-5016 · GHSA-9gm5-4h53-36xh

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18…

LOW 27

The layout engine in Mozilla Firefox 3.x before 3.0.4, Thunderbird 2.x before 2.0.0.18, and SeaMonkey 1.x before 1.1.13 allows remote attackers to cause a denial of service (crash) via multiple vectors that trigger an as…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02271 Published 2008-11-13 Fixed CWE-399

TI-2008-04773 CVE-2008-5019 · GHSA-w542-59hv-5363

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18…

LOW 26

The session restore feature in Mozilla Firefox 3.x before 3.0.4 and 2.x before 2.0.0.18 allows remote attackers to violate the same origin policy to conduct cross-site scripting (XSS) attacks and execute arbitrary JavaSc…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0307 Published 2008-11-13 Fixed CWE-79