Red Hat Security Advisory

RHSA-2009:0315

firefox security update

Released 2009-03-05 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.0.7-1.el5, firefox-3.0.7-1.el5.i386, firefox-3.0.7-1.el5.ia64 +13
Red Hat Enterprise Linux AS version 4 firefox-3.0.7-1.el4, firefox-3.0.7-1.el4.i386, firefox-3.0.7-1.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.7-1.el5, firefox-3.0.7-1.el5.i386, xulrunner-1.9.0.7-1.el5 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner-1.9.0.7-1.el5, xulrunner-devel-1.9.0.7-1.el5, xulrunner-devel-1.9.0.7-1.el5.i386 +2
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.7-1.el4, firefox-3.0.7-1.el4.i386
Red Hat Enterprise Linux ES version 4 firefox-3.0.7-1.el4, firefox-3.0.7-1.el4.i386, firefox-3.0.7-1.el4.ia64
Red Hat Enterprise Linux WS version 4 firefox-3.0.7-1.el4, firefox-3.0.7-1.el4.i386, firefox-3.0.7-1.el4.ia64

Fixes 8 records

TI-2009-00738 CVE-2009-0773 · GHSA-fqq3-4hpj-9cxh

The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and…

MEDIUM 52

The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a splice o…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05789 Published 2009-03-05 Fixed CWE-399

TI-2009-00740 CVE-2009-0775 · GHSA-rgh3-gqjf-4mqv

Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 50

Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a pa…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04709 Published 2009-03-05 Fixed CWE-399

TI-2009-00736 CVE-2009-0771 · GHSA-wqhc-6m34-q79w

The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and…

MEDIUM 50

The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors th…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04613 Published 2009-03-05 Fixed CWE-399

TI-2009-00739 CVE-2009-0774 · GHSA-7366-2x8r-hhqr

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 47

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04047 Published 2009-03-05 Fixed CWE-399

TI-2009-00737 CVE-2009-0772 · GHSA-fxj6-x384-78f9

The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21…

MEDIUM 46

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03722 Published 2009-03-05 Fixed CWE-399

TI-2009-00040 CVE-2009-0040 · GHSA-m968-rq7m-646j

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in…

LOW 38

The PNG reference library (aka libpng) before 1.0.43, and 1.2.x before 1.2.35, as used in pngcrush and other applications, allows context-dependent attackers to cause a denial of service (application crash) or possibly e…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.04825 Published 2009-02-22 Fixed CWE-824

TI-2009-00741 CVE-2009-0776 · GHSA-rq9h-6m6h-p32x

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey…

LOW 34

nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain re…

CVSS 2.0HIGH 7.1 Network No auth Interaction — EPSS 0.016 Published 2009-03-05 Fixed CWE-200

TI-2009-00742 CVE-2009-0777 · GHSA-9q9q-525p-x46x

Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15…

LOW 29

Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01497 Published 2009-03-05 Fixed CWE-20