Red Hat Security Advisory

RHSA-2009:1095

firefox security update

Released 2009-06-11 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.0.11-2.el5_3, firefox-3.0.11-2.el5_3.i386, firefox-3.0.11-2.el5_3.ia64 +13
Red Hat Enterprise Linux AS version 4 firefox-3.0.11-4.el4, firefox-3.0.11-4.el4.i386, firefox-3.0.11-4.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.11-2.el5_3, firefox-3.0.11-2.el5_3.i386, xulrunner-1.9.0.11-3.el5_3 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner-1.9.0.11-3.el5_3, xulrunner-devel-1.9.0.11-3.el5_3, xulrunner-devel-1.9.0.11-3.el5_3.i386 +2
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.11-4.el4, firefox-3.0.11-4.el4.i386
Red Hat Enterprise Linux ES version 4 firefox-3.0.11-4.el4, firefox-3.0.11-4.el4.i386, firefox-3.0.11-4.el4.ia64
Red Hat Enterprise Linux WS version 4 firefox-3.0.11-4.el4, firefox-3.0.11-4.el4.i386, firefox-3.0.11-4.el4.ia64

Fixes 11 records

TI-2009-01745 CVE-2009-1833 · GHSA-3f5w-q39v-gmmh

The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and…

MEDIUM 52

The JavaScript engine in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09176 Published 2009-06-12 Fixed CWE-94

TI-2009-01744 CVE-2009-1832 · GHSA-67qp-3x3r-rx23

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17…

MEDIUM 52

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09176 Published 2009-06-12 Fixed CWE-94

TI-2009-01325 CVE-2009-1392 · GHSA-w6c9-g8ph-r488

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and…

MEDIUM 52

The browser engine in Mozilla Firefox 3 before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly e…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.09282 Published 2009-06-12 Fixed CWE-94

TI-2009-01753 CVE-2009-1841 · GHSA-73qh-76hj-pm8j

js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird…

MEDIUM 48

js/src/xpconnect/src/xpcwrappedjsclass.cpp in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 allows remote attackers to execute arbitrary web script with the privileges of a chrom…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04795 Published 2009-06-12 Fixed CWE-94

TI-2009-01750 CVE-2009-1838 · GHSA-p6f8-2h8r-5246

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird…

MEDIUM 48

The garbage-collection implementation in Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 sets an element's owner document to null in unspecified circumstances, which allows remote…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04795 Published 2009-06-12 Fixed CWE-94

TI-2009-01752 CVE-2009-1840 · GHSA-qvp9-wp54-hp75

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy…

MEDIUM 44

Mozilla Firefox before 3.0.11, Thunderbird, and SeaMonkey do not check content policy before loading a script file into a XUL document, which allows remote attackers to bypass intended access restrictions via a crafted H…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.02224 Published 2009-06-12 Fixed CWE-264

TI-2009-01749 CVE-2009-1837 · GHSA-jcp3-xfrr-gf86

Race condition in the NPObjWrapper_NewResolve function in…

MEDIUM 40

Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to execute arbitrary code via a page transiti…

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.04331 Published 2009-06-12 Fixed CWE-362

TI-2009-01751 CVE-2009-1839 · GHSA-mx4x-6484-3f7v

Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded…

LOW 34

Mozilla Firefox 3 before 3.0.11 associates an incorrect principal with a file: URL loaded through the location bar, which allows user-assisted remote attackers to bypass intended access restrictions and read files via a…

CVSS 2.0MEDIUM 5.4 Network No auth Interaction — EPSS 0.07124 Published 2009-06-12 Fixed CWE-264

TI-2009-01748 CVE-2009-1836 · GHSA-xw48-x32w-4m9r

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17…

LOW 34

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which al…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02032 Published 2009-06-12 Fixed CWE-287

TI-2009-01746 CVE-2009-1834 · GHSA-m6fm-xwqg-f4r6

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox…

LOW 26

Visual truncation vulnerability in netwerk/dns/src/nsIDNService.cpp in Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 allows remote attackers to spoof the location bar via an IDN with invalid Unicode character…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03234 Published 2009-06-12 Fixed CWE-20

TI-2009-01747 CVE-2009-1835 · GHSA-3679-rrg7-2vqr

Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with…

LOW 25

Mozilla Firefox before 3.0.11 and SeaMonkey before 1.1.17 associate local documents with external domain names located after the file:// substring in a URL, which allows user-assisted remote attackers to read arbitrary c…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02325 Published 2009-06-12 Fixed CWE-200