Red Hat Security Advisory

RHSA-2009:1162

firefox security update

Released 2009-07-22 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.0.12-1.el5_3, firefox-3.0.12-1.el5_3.i386, firefox-3.0.12-1.el5_3.ia64 +13
Red Hat Enterprise Linux AS version 4 firefox-3.0.12-1.el4, firefox-3.0.12-1.el4.i386, firefox-3.0.12-1.el4.ia64 +1
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.0.12-1.el5_3, firefox-3.0.12-1.el5_3.i386, xulrunner-1.9.0.12-1.el5_3 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xulrunner-1.9.0.12-1.el5_3, xulrunner-devel-1.9.0.12-1.el5_3, xulrunner-devel-1.9.0.12-1.el5_3.i386 +2
Red Hat Enterprise Linux Desktop version 4 firefox-3.0.12-1.el4, firefox-3.0.12-1.el4.i386
Red Hat Enterprise Linux ES version 4 firefox-3.0.12-1.el4, firefox-3.0.12-1.el4.i386, firefox-3.0.12-1.el4.ia64
Red Hat Enterprise Linux WS version 4 firefox-3.0.12-1.el4, firefox-3.0.12-1.el4.i386, firefox-3.0.12-1.el4.ia64

Fixes 11 records

TI-2009-02352 CVE-2009-2464 · GHSA-qwmc-7c7g-54gx

The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before…

MEDIUM 57

The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.1323 Published 2009-07-22 Fixed CWE-399

TI-2009-02354 CVE-2009-2466 · GHSA-492q-86f5-c96f

The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote…

MEDIUM 52

The JavaScript engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06619 Published 2009-07-22 Fixed CWE-787

TI-2009-02351 CVE-2009-2463 · GHSA-483p-23q4-52hc

Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions…

MEDIUM 52

Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow re…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.06433 Published 2009-07-22 Fixed CWE-189

TI-2009-02357 CVE-2009-2469 · GHSA-vr58-2w95-qccf

Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property…

MEDIUM 51

Mozilla Firefox before 3.0.12 does not properly handle an SVG element that has a property with a watch function and an __defineSetter__ function, which allows remote attackers to cause a denial of service (memory corrupt…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05557 Published 2009-07-22 Fixed CWE-399

TI-2009-02355 CVE-2009-2467 · GHSA-5mp2-ghvf-gw3v

Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a…

MEDIUM 51

Mozilla Firefox before 3.0.12 and 3.5 before 3.5.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving a Flash object, a slow script dialog, a…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05418 Published 2009-07-22 Fixed

TI-2009-02353 CVE-2009-2465 · GHSA-7x2r-cg6w-8rwf

Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of…

MEDIUM 51

Mozilla Firefox before 3.0.12 and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving double frame construction, relat…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05414 Published 2009-07-22 Fixed CWE-399

TI-2009-02350 CVE-2009-2462 · GHSA-gphm-8f5h-pv33

The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote…

MEDIUM 51

The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05414 Published 2009-07-22 Fixed CWE-399

TI-2009-02359 CVE-2009-2471 · GHSA-pcxm-q3h4-prrq

The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve…

MEDIUM 49

The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPC…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.03733 Published 2009-07-22 Fixed

TI-2009-02546 CVE-2009-2664 · GHSA-89w9-2j44-v823

The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla…

LOW 28

The js_watch_set function in js/src/jsdbgapi.cpp in the JavaScript engine in Mozilla Firefox before 3.0.12 allows remote attackers to cause a denial of service (assertion failure and application exit) or possibly execute…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02799 Published 2009-08-04 Fixed CWE-399

TI-2009-02358 CVE-2009-2470 · GHSA-gwmw-74gj-55qx

Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers…

LOW 27

Mozilla Firefox before 3.0.12, and 3.5.x before 3.5.2, allows remote SOCKS5 proxy servers to cause a denial of service (data stream corruption) via a long domain name in a reply.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01991 Published 2009-08-04 Fixed CWE-20

TI-2009-02360 CVE-2009-2472 · GHSA-xwvm-8xx6-229v

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required…

LOW 24

Mozilla Firefox before 3.0.12 does not always use XPCCrossOriginWrapper when required during object construction, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) atta…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02243 Published 2009-07-22 Fixed CWE-79