Red Hat Security Advisory

RHSA-2008:1036

firefox security update

Released 2008-12-17 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.0.5-1.el5_2, firefox-3.0.5-1.el5_2.i386, firefox-3.0.5-1.el5_2.ia64 +37
Red Hat Enterprise Linux AS version 4 firefox-3.0.5-1.el4, firefox-3.0.5-1.el4.i386, firefox-3.0.5-1.el4.ia64 +17
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.5-1.el5_2, firefox-3.0.5-1.el5_2.i386, nspr-4.7.3-2.el5 +7
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr-4.7.3-2.el5, nspr-devel-4.7.3-2.el5, nspr-devel-4.7.3-2.el5.i386 +10
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.5-1.el4, firefox-3.0.5-1.el4.i386, nspr-4.7.3-1.el4 +7
Red Hat Enterprise Linux ES version 4 firefox-3.0.5-1.el4, firefox-3.0.5-1.el4.i386, firefox-3.0.5-1.el4.ia64 +12
Red Hat Enterprise Linux WS version 4 firefox-3.0.5-1.el4, firefox-3.0.5-1.el4.i386, firefox-3.0.5-1.el4.ia64 +12

Fixes 11 records

TI-2008-05217 CVE-2008-5500 · GHSA-6h85-mxrc-rvwx

The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19…

MEDIUM 49

The layout engine in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) and possibly tr…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03201 Published 2008-12-17 Fixed CWE-399

TI-2008-05228 CVE-2008-5512 · GHSA-3rgf-mp4w-9hj8

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before…

LOW 35

Multiple unspecified vulnerabilities in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to run arbitrary JavaScript with c…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02863 Published 2008-12-17 Fixed CWE-264

TI-2008-05223 CVE-2008-5506 · GHSA-rcg4-3qvg-p2xp

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 34

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to bypass the same origin policy by causing the browser to issue an XMLHt…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02091 Published 2008-12-17 Fixed CWE-264

TI-2008-05224 CVE-2008-5507 · GHSA-q2h5-97m4-jvvg

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 30

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allow remote attackers to bypass the same origin policy and access portions of data from another…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.0166 Published 2008-12-17 Fixed CWE-200

TI-2008-05218 CVE-2008-5501 · GHSA-4vx3-3xr8-7q3x

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19…

LOW 29

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service via vectors that trigger an assertion failure.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.03137 Published 2008-12-17 Fixed

TI-2008-05226 CVE-2008-5510 · GHSA-h25j-67c9-vc8j

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird…

LOW 27

The CSS parser in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 ignores the '\0' escaped null character, which might allow remote attackers to…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02212 Published 2008-12-17 Fixed

TI-2008-05222 CVE-2008-5505 · GHSA-7v9j-67p6-63jv

Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy…

LOW 27

Mozilla Firefox 3.x before 3.0.5 allows remote attackers to bypass intended privacy restrictions by using the persist attribute in an XUL element to create and access data entities that are similar to cookies.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02295 Published 2008-12-17 Fixed CWE-264

TI-2008-05219 CVE-2008-5502 · GHSA-jfx6-pmj2-6ffh

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19…

LOW 27

The layout engine in Mozilla Firefox 3.x before 3.0.5, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 allows remote attackers to cause a denial of service (crash) via vectors that trigger memory corrupt…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0227 Published 2008-12-17 Fixed CWE-399

TI-2008-05229 CVE-2008-5513 · GHSA-wpm2-x35v-w8w6

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before…

LOW 24

Unspecified vulnerability in the session-restore feature in Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19 allows remote attackers to bypass the same origin policy, inject content into documents associated with…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01784 Published 2008-12-17 Fixed CWE-79

TI-2008-05227 CVE-2008-5511 · GHSA-wfgh-c975-36mr

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 24

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01856 Published 2008-12-17 Fixed CWE-79

TI-2008-05225 CVE-2008-5508 · GHSA-ggjv-5q8p-39gf

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before…

LOW 24

Mozilla Firefox 3.x before 3.0.5 and 2.x before 2.0.0.19, Thunderbird 2.x before 2.0.0.19, and SeaMonkey 1.x before 1.1.14 does not properly parse URLs with leading whitespace or control characters, which might allow rem…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02222 Published 2008-12-17 Fixed CWE-20