Red Hat Security Advisory

RHSA-2010:0782

firefox security update

Released 2010-10-19 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-3.6.11-2.el5, firefox-3.6.11-2.el5.i386, firefox-3.6.11-2.el5.ia64 +25
Red Hat Enterprise Linux AS version 4 firefox-3.6.11-2.el4, firefox-3.6.11-2.el4.i386, firefox-3.6.11-2.el4.ia64 +13
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.6.11-2.el5, firefox-3.6.11-2.el5.i386, nss-3.12.8-1.el5 +5
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nss-3.12.8-1.el5, nss-devel-3.12.8-1.el5, nss-devel-3.12.8-1.el5.i386 +5
Red Hat Enterprise Linux Desktop version 4 firefox-3.6.11-2.el4, firefox-3.6.11-2.el4.i386, nss-3.12.8-1.el4 +5
Red Hat Enterprise Linux ES version 4 firefox-3.6.11-2.el4, firefox-3.6.11-2.el4.i386, firefox-3.6.11-2.el4.ia64 +9
Red Hat Enterprise Linux WS version 4 firefox-3.6.11-2.el4, firefox-3.6.11-2.el4.i386, firefox-3.6.11-2.el4.ia64 +9

Fixes 10 records

TI-2010-03040 CVE-2010-3179 · GHSA-86hh-v273-w3qf

Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before…

MEDIUM 52

Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows remote attacker…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.10118 Published 2010-10-21 Fixed CWE-119

TI-2010-03044 CVE-2010-3183 · GHSA-254p-9j5r-3fvc

The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and…

MEDIUM 49

The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly support window.__loo…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06451 Published 2010-10-21 Fixed CWE-119

TI-2010-03041 CVE-2010-3180 · GHSA-hw9x-26r4-cfw7

Use-after-free vulnerability in the nsBarProp function in Mozilla Firefox before 3.5.14…

MEDIUM 48

Use-after-free vulnerability in the nsBarProp function in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows remote attackers to exec…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04644 Published 2010-10-21 Fixed CWE-399

TI-2010-03037 CVE-2010-3176 · GHSA-2jf9-c4jx-5qwv

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x…

MEDIUM 47

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allow remote attacker…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0455 Published 2010-10-21 Fixed

TI-2010-03036 CVE-2010-3175 · GHSA-7j7w-5j3h-gcfm

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x…

MEDIUM 46

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x before 3.6.11 and Thunderbird 3.1.x before 3.1.5 allow remote attackers to cause a denial of service (memory corruption and application…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03726 Published 2010-10-21 Fixed

TI-2010-03034 CVE-2010-3173 · GHSA-qx2q-p5g3-ww8g

The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11…

LOW 38

The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly set the minimum key length for Diffie-Hellman…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03036 Published 2010-10-21 Partial fix CWE-310

TI-2010-03043 CVE-2010-3182 · GHSA-j62p-q592-cjfv

A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before…

LOW 30

A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in th…

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00286 Published 2010-10-21 Fixed

TI-2010-03039 CVE-2010-3178 · GHSA-f7fh-pf49-jf37

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x…

LOW 29

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 do not properly handle certain modal calls made by javascript: URLs in circumstances rela…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01398 Published 2010-10-21 Fixed CWE-264

TI-2010-03038 CVE-2010-3177 · GHSA-hvcx-xp6v-2hrj

Multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser in Mozilla…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, and SeaMonkey before 2.0.9, allow remote attackers to inject arbitrary web script or HTML…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02064 Published 2010-10-21 Fixed CWE-79

TI-2010-03031 CVE-2010-3170 · GHSA-73h9-xvxv-frc7

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x…

LOW 22

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificat…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01096 Published 2010-10-21 Fixed CWE-310