Red Hat Security Advisory

RHSA-2012:0710

firefox security update

Released 2012-06-05 · Red Hat rating Critical · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) xulrunner-10.0.5-1.el5_8, xulrunner-devel-10.0.5-1.el5_8, xulrunner-devel-10.0.5-1.el5_8.i386
Red Hat Enterprise Linux (v. 5 server) firefox-10.0.5-1.el5_8, firefox-10.0.5-1.el5_8.i386, firefox-10.0.5-1.el5_8.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-10.0.5-1.el5_8, firefox-10.0.5-1.el5_8.i386, xulrunner-10.0.5-1.el5_8 +1
Red Hat Enterprise Linux Desktop (v. 6) firefox-10.0.5-1.el6_2, xulrunner-10.0.5-1.el6_2
Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-10.0.5-1.el6_2, xulrunner-devel-10.0.5-1.el6_2
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-10.0.5-1.el6_2, xulrunner-10.0.5-1.el6_2, xulrunner-devel-10.0.5-1.el6_2
Red Hat Enterprise Linux Server (v. 6) firefox-10.0.5-1.el6_2, firefox-10.0.5-1.el6_2.ppc, xulrunner-10.0.5-1.el6_2 +1
Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-10.0.5-1.el6_2, xulrunner-devel-10.0.5-1.el6_2, xulrunner-devel-10.0.5-1.el6_2.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-10.0.5-1.el6_2, xulrunner-10.0.5-1.el6_2
Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-10.0.5-1.el6_2, xulrunner-devel-10.0.5-1.el6_2

Fixes 11 records

TI-2012-01718 CVE-2012-1941 · GHSA-vcfw-h6w7-62j7

Heap-based buffer overflow in the nsHTMLReflowState::CalculateHypotheticalBox function in…

MEDIUM 48

Heap-based buffer overflow in the nsHTMLReflowState::CalculateHypotheticalBox function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04759 Published 2012-06-05 Fixed CWE-119

TI-2012-01715 CVE-2012-1938 · GHSA-rqmw-wp6r-645h

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 48

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and app…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04804 Published 2012-06-05 Fixed

TI-2012-01714 CVE-2012-1937 · GHSA-qcq5-2476-cvmq

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through…

MEDIUM 48

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04648 Published 2012-06-05 Fixed

TI-2012-01724 CVE-2012-1947 · GHSA-22c8-wr9r-qr3j

Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x…

MEDIUM 47

Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04582 Published 2012-06-05 Fixed CWE-119

TI-2012-01723 CVE-2012-1946 · GHSA-p4rr-fgvx-ch95

Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla…

MEDIUM 47

Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMo…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04365 Published 2012-06-05 Fixed CWE-399

TI-2012-01717 CVE-2012-1940 · GHSA-rqvr-fvm8-wh8c

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox…

MEDIUM 47

Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey be…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0444 Published 2012-06-05 Fixed CWE-399

TI-2012-02657 CVE-2012-3105 · GHSA-7p2c-gjhf-hwwv

The glBufferData function in the WebGL implementation in Mozilla Firefox 4.x through…

MEDIUM 46

The glBufferData function in the WebGL implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03618 Published 2012-06-05 Fixed CWE-119

TI-2012-01716 CVE-2012-1939 · GHSA-g43v-55jg-34cf

jsinfer.cpp in Mozilla Firefox ESR 10.x before 10.0.5 and Thunderbird ESR 10.x before…

MEDIUM 46

jsinfer.cpp in Mozilla Firefox ESR 10.x before 10.0.5 and Thunderbird ESR 10.x before 10.0.5 does not properly determine data types, which allows remote attackers to cause a denial of service (memory corruption and appli…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03123 Published 2012-06-05 Fixed CWE-119

TI-2011-02738 CVE-2011-3101 · GHSA-26x4-q5xq-8jvc

Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw…

MEDIUM 46

Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.01808 Published 2012-05-16 Fixed

TI-2012-01721 CVE-2012-1944 · GHSA-mpv9-qhv2-p7fj

The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0…

LOW 24

The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not b…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01815 Published 2012-06-05 Fixed CWE-79

TI-2012-01722 CVE-2012-1945 · GHSA-xqrh-6pmp-4rgf

Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through…

LOW 15

Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML…

CVSS 2.0LOW 2.9 Adjacent network No auth Interaction — EPSS 0.00457 Published 2012-06-05 Fixed CWE-200