Red Hat Security Advisory

RHSA-2013:0144

firefox security update

Released 2013-01-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-10.0.12-1.el5_9, firefox-10.0.12-1.el5_9.i386, firefox-10.0.12-1.el5_9.ia64 +9
Red Hat Enterprise Linux Desktop (v. 6) firefox-10.0.12-1.el6_3, xulrunner-10.0.12-1.el6_3
Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-10.0.12-1.el6_3, xulrunner-devel-10.0.12-1.el6_3
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-10.0.12-1.el6_3, xulrunner-10.0.12-1.el6_3, xulrunner-devel-10.0.12-1.el6_3
Red Hat Enterprise Linux Server (v. 6) firefox-10.0.12-1.el6_3, firefox-10.0.12-1.el6_3.ppc, xulrunner-10.0.12-1.el6_3 +1
Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-10.0.12-1.el6_3, xulrunner-devel-10.0.12-1.el6_3, xulrunner-devel-10.0.12-1.el6_3.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-10.0.12-1.el6_3, xulrunner-10.0.12-1.el6_3
Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-10.0.12-1.el6_3, xulrunner-devel-10.0.12-1.el6_3

Fixes 12 records

TI-2013-00642 CVE-2013-0758 · GHSA-7p7h-fc6x-mhrh

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2…

HIGH 78

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.73364 Published 2013-01-13 Partial fix CWE-94

TI-2013-00637 CVE-2013-0753 · GHSA-6x74-c24h-qxmw

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer…

HIGH 72

Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thund…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.51324 Published 2013-01-13 Partial fix CWE-416

TI-2013-00651 CVE-2013-0767 · GHSA-q6xj-ccv4-mg5m

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox…

MEDIUM 52

The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05815 Published 2013-01-13 Partial fix CWE-125

TI-2013-00653 CVE-2013-0769 · GHSA-g6pf-m7h6-6vmf

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 49

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x b…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05784 Published 2013-01-13 Partial fix

TI-2013-00634 CVE-2013-0750 · GHSA-f77x-4q67-r7px

Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox…

MEDIUM 49

Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.0633 Published 2013-01-13 Partial fix CWE-190

TI-2013-00628 CVE-2013-0744 · GHSA-hfm6-8rw8-xwh8

Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy…

MEDIUM 49

Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunder…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.06147 Published 2013-01-13 Partial fix CWE-416

TI-2013-00650 CVE-2013-0766 · GHSA-ch2j-4j2j-86w9

Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox…

MEDIUM 48

Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 a…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04713 Published 2013-01-13 Partial fix CWE-416

TI-2013-00646 CVE-2013-0762 · GHSA-jwff-wj44-mfx2

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox…

MEDIUM 48

Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04713 Published 2013-01-13 Partial fix CWE-416

TI-2013-00638 CVE-2013-0754 · GHSA-r74x-hg5r-c58j

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox…

MEDIUM 48

Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 an…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.05381 Published 2013-01-13 Partial fix CWE-416

TI-2013-00630 CVE-2013-0746 · GHSA-465r-4h5w-cg33

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2…

MEDIUM 47

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.04485 Published 2013-01-13 Partial fix

TI-2013-00643 CVE-2013-0759 · GHSA-hxp4-gmmw-6q3w

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2…

LOW 27

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02284 Published 2013-01-13 Partial fix CWE-287

TI-2013-00632 CVE-2013-0748 · GHSA-mj3v-vm8j-wm4f

The XBL.proto.toString implementation in Mozilla Firefox before 18.0, Firefox ESR…

LOW 24

The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01998 Published 2013-01-13 Partial fix CWE-200