Red Hat Security Advisory

RHSA-2012:0515

firefox security update

Released 2012-04-24 · Red Hat rating Critical · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) xulrunner-10.0.4-1.el5_8, xulrunner-devel-10.0.4-1.el5_8, xulrunner-devel-10.0.4-1.el5_8.i386
Red Hat Enterprise Linux (v. 5 server) firefox-10.0.4-1.el5_8, firefox-10.0.4-1.el5_8.i386, firefox-10.0.4-1.el5_8.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-10.0.4-1.el5_8, firefox-10.0.4-1.el5_8.i386, xulrunner-10.0.4-1.el5_8 +1
Red Hat Enterprise Linux Desktop (v. 6) firefox-10.0.4-1.el6_2, xulrunner-10.0.4-1.el6_2
Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-10.0.4-1.el6_2, xulrunner-devel-10.0.4-1.el6_2
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-10.0.4-1.el6_2, xulrunner-10.0.4-1.el6_2, xulrunner-devel-10.0.4-1.el6_2
Red Hat Enterprise Linux Server (v. 6) firefox-10.0.4-1.el6_2, firefox-10.0.4-1.el6_2.ppc, xulrunner-10.0.4-1.el6_2 +1
Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-10.0.4-1.el6_2, xulrunner-devel-10.0.4-1.el6_2, xulrunner-devel-10.0.4-1.el6_2.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-10.0.4-1.el6_2, xulrunner-10.0.4-1.el6_2
Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-10.0.4-1.el6_2, xulrunner-devel-10.0.4-1.el6_2

Fixes 12 records

TI-2012-00423 CVE-2012-0470 · GHSA-r5mf-grcq-wjjg

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in…

MEDIUM 55

Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4,…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.10175 Published 2012-04-25 Fixed CWE-119

TI-2012-00422 CVE-2012-0469 · GHSA-86c5-mchr-88xj

Use-after-free vulnerability in the…

MEDIUM 53

Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.07288 Published 2012-04-25 Fixed CWE-399

TI-2012-00420 CVE-2012-0467 · GHSA-pfrh-p5fc-r8vj

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 a…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0553 Published 2012-04-25 Fixed

TI-2012-00421 CVE-2012-0468 · GHSA-gj4g-fgvc-6grf

The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and…

MEDIUM 50

The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly ex…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.04121 Published 2012-04-25 Fixed CWE-119

TI-2012-00425 CVE-2012-0472 · GHSA-555h-vj7w-v68w

The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x…

MEDIUM 47

The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0407 Published 2012-04-25 Fixed CWE-119

TI-2012-00430 CVE-2012-0478 · GHSA-j6wg-r6cx-hpqm

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0…

MEDIUM 46

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 does no…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03469 Published 2012-04-25 Fixed CWE-264

TI-2011-02700 CVE-2011-3062 · GHSA-fr3j-gxg3-m435

Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows…

LOW 33

Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0168 Published 2012-03-30 Fixed CWE-682

TI-2012-00426 CVE-2012-0473 · GHSA-xv8q-vwcv-3mcg

The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0…

LOW 26

The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the Fin…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01653 Published 2012-04-25 Fixed CWE-189

TI-2012-00431 CVE-2012-0479 · GHSA-wxrh-7vjc-327g

Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through…

LOW 24

Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https UR…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02213 Published 2012-04-25 Fixed

TI-2012-00429 CVE-2012-0477 · GHSA-g8qf-h77h-c3gw

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow re…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0201 Published 2012-04-25 Fixed CWE-79

TI-2012-00427 CVE-2012-0474 · GHSA-66r3-h3v8-4pjm

Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla…

LOW 24

Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01877 Published 2012-04-25 Fixed CWE-79

TI-2012-00424 CVE-2012-0471 · GHSA-6c73-66gj-rv5f

Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR…

LOW 24

Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attac…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0201 Published 2012-04-25 Fixed CWE-79