Red Hat Security Advisory

RHSA-2012:1482

firefox security update

Released 2012-11-20 · Red Hat rating Critical · View on Red Hat →

Fixed in

RHEL Desktop Workstation (v. 5 client) xulrunner-10.0.11-1.el5_8, xulrunner-devel-10.0.11-1.el5_8, xulrunner-devel-10.0.11-1.el5_8.i386
Red Hat Enterprise Linux (v. 5 server) firefox-10.0.11-1.el5_8, firefox-10.0.11-1.el5_8.i386, firefox-10.0.11-1.el5_8.ia64 +9
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-10.0.11-1.el5_8, firefox-10.0.11-1.el5_8.i386, xulrunner-10.0.11-1.el5_8 +1
Red Hat Enterprise Linux Desktop (v. 6) firefox-10.0.11-1.el6_3, xulrunner-10.0.11-1.el6_3
Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-10.0.11-1.el6_3, xulrunner-devel-10.0.11-1.el6_3
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-10.0.11-1.el6_3, xulrunner-10.0.11-1.el6_3, xulrunner-devel-10.0.11-1.el6_3
Red Hat Enterprise Linux Server (v. 6) firefox-10.0.11-1.el6_3, firefox-10.0.11-1.el6_3.ppc, xulrunner-10.0.11-1.el6_3 +1
Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-10.0.11-1.el6_3, xulrunner-devel-10.0.11-1.el6_3, xulrunner-devel-10.0.11-1.el6_3.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-10.0.11-1.el6_3, xulrunner-10.0.11-1.el6_3
Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-10.0.11-1.el6_3, xulrunner-devel-10.0.11-1.el6_3

Fixes 16 records

TI-2012-04872 CVE-2012-5835 · GHSA-wqr9-hj2x-xfmw

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x…

MEDIUM 54

Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08528 Published 2012-11-21 Fixed CWE-190

TI-2012-03590 CVE-2012-4202 · GHSA-3346-5fc6-qhpc

Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla…

MEDIUM 53

Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey befo…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.11079 Published 2012-11-21 Fixed CWE-787

TI-2012-04869 CVE-2012-5829 · GHSA-5h6m-6wc7-jxv6

Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox…

MEDIUM 51

Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.08439 Published 2012-11-21 Fixed CWE-787

TI-2012-04876 CVE-2012-5839 · GHSA-f9x4-662x-q5m7

Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function…

MEDIUM 50

Heap-based buffer overflow in the gfxShapedWord::CompressedGlyph::IsClusterStart function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06997 Published 2012-11-21 Fixed CWE-787

TI-2012-04877 CVE-2012-5840 · GHSA-3355-xw7j-q4q7

Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla…

MEDIUM 49

Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey b…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06074 Published 2012-11-21 Fixed CWE-416

TI-2012-03603 CVE-2012-4216 · GHSA-pv6w-73jg-c3fq

Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox…

MEDIUM 49

Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06074 Published 2012-11-21 Fixed CWE-416

TI-2012-03602 CVE-2012-4215 · GHSA-cmxq-2fpg-2x83

Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in…

MEDIUM 49

Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMon…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06074 Published 2012-11-21 Fixed CWE-416

TI-2012-03601 CVE-2012-4214 · GHSA-583w-j396-26w8

Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla…

MEDIUM 49

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06074 Published 2012-11-21 Fixed CWE-416

TI-2012-04879 CVE-2012-5842 · GHSA-3g85-fvg2-5gw5

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 48

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allow re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04789 Published 2012-11-21 Fixed

TI-2012-04871 CVE-2012-5833 · GHSA-fcm5-39j7-xpvf

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0…

MEDIUM 48

The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not prope…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0483 Published 2012-11-21 Fixed CWE-119

TI-2012-03598 CVE-2012-4210 · GHSA-vghf-6629-65jw

The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11…

MEDIUM 46

The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted re…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03528 Published 2012-11-21 Fixed CWE-264

TI-2012-04870 CVE-2012-5830 · GHSA-8g8g-2rjp-3346

Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before…

MEDIUM 45

Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.03814 Published 2012-11-21 Fixed CWE-416

TI-2012-03589 CVE-2012-4201 · GHSA-6fwr-vrgr-xcw8

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before…

LOW 26

The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03083 Published 2012-11-21 Fixed CWE-79

TI-2012-03597 CVE-2012-4209 · GHSA-mc6f-7xm8-q752

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0…

LOW 25

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02546 Published 2012-11-21 Fixed CWE-79

TI-2012-03595 CVE-2012-4207 · GHSA-jprg-6jgr-c6j9

The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR…

LOW 25

The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handl…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02781 Published 2012-11-21 Fixed CWE-79

TI-2012-04878 CVE-2012-5841 · GHSA-gw44-5pc8-vhfq

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0…

LOW 24

Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 implement cross-origin wrappers with a filtering behavior that does no…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0193 Published 2012-11-21 Fixed CWE-79