Red Hat Security AdvisoryRHSA-2011:1341
firefox security update
Released 2011-09-28 · Red Hat rating Critical · View on Red Hat →
Fixed in
- RHEL Desktop Workstation (v. 5 client) xulrunner-1.9.2.23-1.el5_7, xulrunner-devel-1.9.2.23-1.el5_7, xulrunner-devel-1.9.2.23-1.el5_7.i386
- Red Hat Enterprise Linux (v. 5 server) firefox-3.6.23-2.el5_7, firefox-3.6.23-2.el5_7.i386, firefox-3.6.23-2.el5_7.ia64 +9
- Red Hat Enterprise Linux AS version 4 firefox-3.6.23-1.el4, firefox-3.6.23-1.el4.i386, firefox-3.6.23-1.el4.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.6.23-2.el5_7, firefox-3.6.23-2.el5_7.i386, xulrunner-1.9.2.23-1.el5_7 +1
- Red Hat Enterprise Linux Desktop version 4 firefox-3.6.23-1.el4, firefox-3.6.23-1.el4.i386
- Red Hat Enterprise Linux ES version 4 firefox-3.6.23-1.el4, firefox-3.6.23-1.el4.i386, firefox-3.6.23-1.el4.ia64
- Red Hat Enterprise Linux Server (v. 6) firefox-3.6.23-2.el6_1, firefox-3.6.23-2.el6_1.ppc, xulrunner-1.9.2.23-1.el6_1.1 +1
- Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-1.9.2.23-1.el6_1.1, xulrunner-devel-1.9.2.23-1.el6_1.1, xulrunner-devel-1.9.2.23-1.el6_1.1.ppc
- Red Hat Enterprise Linux WS version 4 firefox-3.6.23-1.el4, firefox-3.6.23-1.el4.i386, firefox-3.6.23-1.el4.ia64
Fixes 5 records
Priority MEDIUM 51
Integer underflow in Mozilla Firefox 3.6.x before 3.6.23 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via JavaScript code containing a large RegExp expressio…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.05368 · Published 2011-09-30 · Fixed CWE-189
Priority MEDIUM 50
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 allow remote attackers to cause a denial of service (memory…
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.04372 · Published 2011-09-29 · Partial fix
Priority LOW 24
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not properly handle HTTP responses that contain multiple Location, Content-Length, or Content-Disposition headers, whic…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.02018 · Published 2011-09-29 · Partial fix CWE-94
Priority LOW 22
Mozilla Firefox before 3.6.23 and 4.x through 5, Thunderbird before 6.0, and SeaMonkey before 2.3 do not properly handle "location" as the name of a frame, which allows remote attackers to bypass the Same Origin Policy v…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01095 · Published 2011-09-29 · Fixed CWE-264
Priority LOW 19
Mozilla Firefox before 3.6.23 and 4.x through 6, Thunderbird before 7.0, and SeaMonkey before 2.4 do not prevent the starting of a download in response to the holding of the Enter key, which allows user-assisted remote a…
CVSS 2.0LOW 3.5· Network · Low privileges · Interaction — · EPSS 0.00921 · Published 2011-09-29 · Partial fix CWE-264
THREATIST.IORead the docs