Red Hat Security Advisory

RHSA-2013:0981

firefox security update

Released 2013-06-25 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-17.0.7-1.el5_9, firefox-17.0.7-1.el5_9.i386, firefox-17.0.7-1.el5_9.ia64 +9
Red Hat Enterprise Linux Desktop (v. 6) firefox-17.0.7-1.el6_4, xulrunner-17.0.7-1.el6_4
Red Hat Enterprise Linux Desktop Optional (v. 6) xulrunner-17.0.7-1.el6_4, xulrunner-devel-17.0.7-1.el6_4
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-17.0.7-1.el6_4, xulrunner-17.0.7-1.el6_4, xulrunner-devel-17.0.7-1.el6_4
Red Hat Enterprise Linux Server (v. 6) firefox-17.0.7-1.el6_4, firefox-17.0.7-1.el6_4.ppc, xulrunner-17.0.7-1.el6_4 +1
Red Hat Enterprise Linux Server Optional (v. 6) xulrunner-17.0.7-1.el6_4, xulrunner-devel-17.0.7-1.el6_4, xulrunner-devel-17.0.7-1.el6_4.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-17.0.7-1.el6_4, xulrunner-17.0.7-1.el6_4
Red Hat Enterprise Linux Workstation Optional (v. 6) xulrunner-17.0.7-1.el6_4, xulrunner-devel-17.0.7-1.el6_4

Fixes 10 records

TI-2013-01487 CVE-2013-1690 · GHSA-m5w3-m6g8-4mhf

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7…

CRITICAL 97KEV

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which al…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.69021 Published 2013-06-26 Partial fix CWE-119

TI-2013-01483 CVE-2013-1686 · GHSA-533v-g3wc-hm43

Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before…

MEDIUM 51

Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05397 Published 2013-06-26 Partial fix CWE-399

TI-2013-01479 CVE-2013-1682 · GHSA-3823-3p6j-72p3

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before…

MEDIUM 51

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.05397 Published 2013-06-26 Partial fix

TI-2013-01493 CVE-2013-1697 · GHSA-cv9x-mgf7-jrm6

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before…

MEDIUM 46

The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method c…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03166 Published 2013-06-26 Partial fix CWE-264

TI-2013-01484 CVE-2013-1687 · GHSA-r57r-cv7v-6687

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla…

MEDIUM 46

The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prope…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03337 Published 2013-06-26 Partial fix CWE-264

TI-2013-01482 CVE-2013-1685 · GHSA-74g7-fq4w-52v7

Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla…

MEDIUM 46

Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote att…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03537 Published 2013-06-26 Partial fix CWE-399

TI-2013-01481 CVE-2013-1684 · GHSA-659g-jfxg-2j3j

Use-after-free vulnerability in the…

MEDIUM 46

Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.03537 Published 2013-06-26 Partial fix CWE-399

TI-2013-01490 CVE-2013-1694 · GHSA-39fr-7764-c9rw

The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x…

MEDIUM 40

The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which a…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04603 Published 2013-06-26 Partial fix CWE-20

TI-2013-01489 CVE-2013-1693 · GHSA-rw38-97rx-85hc

The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before…

LOW 26

The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly b…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03745 Published 2013-06-26 Partial fix CWE-264

TI-2013-01488 CVE-2013-1692 · GHSA-6wqq-ghxp-r688

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7…

LOW 24

Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it e…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02011 Published 2013-06-26 Partial fix CWE-264