Red Hat Security Advisory

RHSA-2016:2780

firefox security update

Released 2016-11-16 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) firefox-45.5.0-1.el5_11, firefox-45.5.0-1.el5_11.i386
Red Hat Enterprise Linux Client (v. 7) firefox-45.5.0-1.el7_3
Red Hat Enterprise Linux Client Optional (v. 7) firefox-45.5.0-1.el7_3
Red Hat Enterprise Linux Desktop (v. 5 client) firefox-45.5.0-1.el5_11, firefox-45.5.0-1.el5_11.i386
Red Hat Enterprise Linux Desktop (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux Server (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux Server (v. 7) firefox-45.5.0-1.el7_3
Red Hat Enterprise Linux Server Optional (v. 6) firefox-45.5.0-1.el6_8, firefox-45.5.0-1.el6_8.ppc
Red Hat Enterprise Linux Server Optional (v. 7) firefox-45.5.0-1.el7_3, firefox-45.5.0-1.el7_3.ppc
Red Hat Enterprise Linux Workstation (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux Workstation (v. 7) firefox-45.5.0-1.el7_3
Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-45.5.0-1.el6_8
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-45.5.0-1.el7_3

TI-2016-04593 CVE-2016-5297 · GHSA-3h9f-q3m2-wjhj

MEDIUM 48

An error in argument length checking in JavaScript, leading to potential integer overflows or other bounds checking issues.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03531 Published 2018-06-11 Fixed in 45.5, 50 CWE-190

TI-2016-04586 CVE-2016-5290 · GHSA-qf56-xjg6-qx59

MEDIUM 48

Memory safety bugs were reported in Firefox 49 and Firefox ESR 45.4.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03212 Published 2018-06-11 Fixed in 45.5, 50 CWE-119

TI-2016-07420 CVE-2016-9066 · GHSA-m65c-6q88-9x7g

MEDIUM 47

A buffer overflow resulting in a potentially exploitable crash due to memory allocation issues when handling large amounts of incoming data.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.12024 Published 2018-06-11 Fixed in 45.5, 50 CWE-119

TI-2016-04592 CVE-2016-5296 · GHSA-q9hf-wj5h-x9vx

LOW 39

A heap-buffer-overflow in Cairo when processing SVG content caused by compiler optimization, resulting in a potentially exploitable crash.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03387 Published 2018-06-11 Fixed in 45.5, 50 CWE-119

TI-2016-07418 CVE-2016-9064 · GHSA-pc4v-68rv-24q5

LOW 28

Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated.

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.00992 Published 2018-06-11 Fixed in 45.5, 50 CWE-295

TI-2016-04587 CVE-2016-5291 · GHSA-5rpq-63gx-j9m8

LOW 25

A same-origin policy bypass with local shortcut files to load arbitrary local content from disk.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00433 Published 2018-06-11 Fixed in 45.5, 50 CWE-20