Red Hat Security AdvisoryRHSA-2011:0310
firefox security and bug fix update
Released 2011-03-02 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5.6.z server) firefox-3.6.14-4.el5_6, firefox-3.6.14-4.el5_6.i386, firefox-3.6.14-4.el5_6.ia64 +9
- Red Hat Enterprise Linux AS version 4 firefox-3.6.14-4.el4, firefox-3.6.14-4.el4.i386, firefox-3.6.14-4.el4.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 6) firefox-3.6.14-4.el6_0, xulrunner-1.9.2.14-3.el6_0
- Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-1.9.2.14-3.el6_0, xulrunner-devel-1.9.2.14-3.el6_0
- Red Hat Enterprise Linux Desktop version 4 firefox-3.6.14-4.el4, firefox-3.6.14-4.el4.i386
- Red Hat Enterprise Linux ES version 4 firefox-3.6.14-4.el4, firefox-3.6.14-4.el4.i386, firefox-3.6.14-4.el4.ia64
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-3.6.14-4.el6_0, xulrunner-1.9.2.14-3.el6_0, xulrunner-devel-1.9.2.14-3.el6_0
- Red Hat Enterprise Linux Server (v. 6) firefox-3.6.14-4.el6_0, xulrunner-1.9.2.14-3.el6_0, xulrunner-1.9.2.14-3.el6_0.ppc
- Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-1.9.2.14-3.el6_0, xulrunner-devel-1.9.2.14-3.el6_0, xulrunner-devel-1.9.2.14-3.el6_0.ppc
- Red Hat Enterprise Linux WS version 4 firefox-3.6.14-4.el4, firefox-3.6.14-4.el4.i386, firefox-3.6.14-4.el4.ia64
- Red Hat Enterprise Linux Workstation (v. 6) firefox-3.6.14-4.el6_0, xulrunner-1.9.2.14-3.el6_0
- Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-1.9.2.14-3.el6_0, xulrunner-devel-1.9.2.14-3.el6_0
Fixes 11 records
Priority MEDIUM 53
Use-after-free vulnerability in the JSON.stringify method in js3250.dll in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via un…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.072 · Published 2011-03-02 · Fixed CWE-399
Priority MEDIUM 52
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 allow remote attackers to cause a denial of servi…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.05787 · Published 2011-03-02 · Partial fix
Priority MEDIUM 51
Buffer overflow in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a l…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.05497 · Published 2011-03-02 · Fixed CWE-119
Priority MEDIUM 50
Use-after-free vulnerability in the Web Workers implementation in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to execute arbitrary code via vectors related…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.0472 · Published 2011-03-02 · Fixed CWE-399
Priority MEDIUM 50
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving exception timin…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04554 · Published 2011-03-02 · Fixed CWE-119
Priority MEDIUM 50
Buffer overflow in the JavaScript engine in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, might allow remote attackers to execute arbitrary code via vectors involving non-local JavaS…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04554 · Published 2011-03-02 · Fixed CWE-119
Priority MEDIUM 49
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x before 3.6.14 and Thunderbird 3.1.x before 3.1.8 allow remote attackers to cause a denial of service (memory corruption and application…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.03849 · Published 2011-03-02 · Fixed
Priority MEDIUM 48
Buffer overflow in Mozilla Firefox 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.04698 · Published 2011-03-02 · Fixed CWE-119
Priority MEDIUM 47
The nsIScriptableUnescapeHTML.parseFragment method in the ParanoidFragmentSink protection mechanism in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, Thunderbird before 3.1.8, and SeaMonkey before 2.0.12 does not…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.04471 · Published 2010-04-28 · Fixed CWE-20
Priority LOW 34
Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, does not properly handle certain recursive eval calls, which makes it easier for remote attackers to force a user to respond positively…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.01823 · Published 2011-03-02 · Partial fix CWE-20
Priority LOW 32
Cross-site request forgery (CSRF) vulnerability in Mozilla Firefox before 3.5.17 and 3.6.x before 3.6.14, and SeaMonkey before 2.0.12, allows remote attackers to hijack the authentication of arbitrary users for requests…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.00967 · Published 2011-03-02 · Fixed CWE-352
THREATIST.IORead the docs