Red Hat Security AdvisoryRHSA-2011:1437
firefox security update
Released 2011-11-08 · Red Hat rating Critical · View on Red Hat →
Fixed in
- RHEL Desktop Workstation (v. 5 client) xulrunner-1.9.2.24-2.el5_7, xulrunner-devel-1.9.2.24-2.el5_7, xulrunner-devel-1.9.2.24-2.el5_7.i386
- Red Hat Enterprise Linux (v. 5 server) firefox-3.6.24-3.el5_7, firefox-3.6.24-3.el5_7.i386, firefox-3.6.24-3.el5_7.ia64 +9
- Red Hat Enterprise Linux AS version 4 firefox-3.6.24-3.el4, firefox-3.6.24-3.el4.i386, firefox-3.6.24-3.el4.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) firefox-3.6.24-3.el5_7, firefox-3.6.24-3.el5_7.i386, xulrunner-1.9.2.24-2.el5_7 +1
- Red Hat Enterprise Linux Desktop version 4 firefox-3.6.24-3.el4, firefox-3.6.24-3.el4.i386
- Red Hat Enterprise Linux ES version 4 firefox-3.6.24-3.el4, firefox-3.6.24-3.el4.i386, firefox-3.6.24-3.el4.ia64
- Red Hat Enterprise Linux Server (v. 6) firefox-3.6.24-3.el6_1, firefox-3.6.24-3.el6_1.ppc, xulrunner-1.9.2.24-2.el6_1.1 +1
- Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-1.9.2.24-2.el6_1.1, xulrunner-devel-1.9.2.24-2.el6_1.1, xulrunner-devel-1.9.2.24-2.el6_1.1.ppc
- Red Hat Enterprise Linux WS version 4 firefox-3.6.24-3.el4, firefox-3.6.24-3.el4.i386, firefox-3.6.24-3.el4.ia64
Fixes 3 records
Priority MEDIUM 45
Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 do not properly handle JavaScript files that contain many functions, which allows user-assisted remote attackers to cause…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.0233 · Published 2011-11-09 · Fixed CWE-119
Priority MEDIUM 44
The JSSubScriptLoader in Mozilla Firefox before 3.6.24 and Thunderbird before 3.1.6 does not properly handle XPCNativeWrappers during calls to the loadSubScript method in an add-on, which makes it easier for remote attac…
CVSS 2.0HIGH 9.3· Network · No auth · Interaction — · EPSS 0.01876 · Published 2011-11-09 · Fixed CWE-20
Priority LOW 23
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 3.6.24 and 4.x through 7.0 and Thunderbird before 3.1.6 and 5.0 through 7.0 allows remote attackers to inject arbitrary web script or HTML via crafted te…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01466 · Published 2011-11-09 · Fixed CWE-79
THREATIST.IORead the docs