Red Hat Security AdvisoryRHSA-2015:1982
firefox security update
Released 2015-11-04 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) firefox-38.4.0-1.el5_11, firefox-38.4.0-1.el5_11.i386
- Red Hat Enterprise Linux Client (v. 7) firefox-38.4.0-1.el7_1
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-38.4.0-1.el7_1
- Red Hat Enterprise Linux Desktop (v. 5 client) firefox-38.4.0-1.el5_11, firefox-38.4.0-1.el5_11.i386
- Red Hat Enterprise Linux Desktop (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux Server (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux Server (v. 7) firefox-38.4.0-1.ael7b_1, firefox-38.4.0-1.el7_1
- Red Hat Enterprise Linux Server Optional (v. 6) firefox-38.4.0-1.el6_7, firefox-38.4.0-1.el6_7.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-38.4.0-1.el7_1, firefox-38.4.0-1.el7_1.ppc
- Red Hat Enterprise Linux Workstation (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux Workstation (v. 7) firefox-38.4.0-1.el7_1
- Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-38.4.0-1.el6_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-38.4.0-1.el7_1
Fixes 10 records
Priority MEDIUM 40
Buffer underflow in libjar in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ZIP arc…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.04229 · Published 2015-11-05 · Fixed CWE-119
Priority LOW 39
The (1) AddWeightedPathSegLists and (2) SVGPathSegListSMILType::Interpolate functions in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lack status checking, which allows remote attackers to cause a denial…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03149 · Published 2015-11-05 · Fixed CWE-119
Priority LOW 39
Buffer overflow in the rx::TextureStorage11 class in ANGLE, as used in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, allows remote attackers to cause a denial of service (memory corruption) or possibly ha…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03218 · Published 2015-11-05 · Fixed CWE-119
Priority LOW 39
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to cause a denial of service (memory corruption and application crash) or…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03892 · Published 2015-11-05 · Fixed CWE-119
Priority LOW 38
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly follow the CORS cross-origin request algorithm for the POST method in situations involving an unspecified Content-Type header manipulation, which al…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02841 · Published 2015-11-05 · Fixed CWE-254
Priority LOW 38
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allow remote attackers to bypass the Same Origin Policy for an IP address origin, and conduct cross-site scripting (XSS) attacks, by appending whitespace chara…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.03097 · Published 2015-11-05 · Fixed CWE-254
Priority LOW 37
The CryptoKey interface implementation in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 lacks status checking, which allows attackers to have an unspecified impact via vectors related to a cryptographic ke…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.0214 · Published 2015-11-05 · Fixed CWE-17
Priority LOW 36
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4, when a Java plugin is enabled, allow remote attackers to cause a denial of service (incorrect garbage collection and application crash) or possibly execute ar…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.03661 · Published 2015-11-05 · Fixed CWE-17
Priority LOW 36
Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via v…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.0311 · Published 2015-11-05 · Fixed CWE-119
Priority LOW 28
Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 improperly control the ability of a web worker to create a WebSocket object, which allows remote attackers to bypass intended mixed-content restrictions via cr…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.02535 · Published 2015-11-05 · Fixed CWE-264
THREATIST.IORead the docs