TI-2017-03403 CVE-2017-5375 · GHSA-m73w-mj59-ggvj
Memory corruption in Mozilla Thunderbird
Priority HIGH 67
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.
RHSA-2017:0190
firefox security update
Released 2017-01-25 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux (v. 5 server) firefox-45.7.0-2.el5_11, firefox-45.7.0-2.el5_11.i386
- Red Hat Enterprise Linux Client (v. 7) firefox-45.7.0-2.el7_3
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-45.7.0-2.el7_3
- Red Hat Enterprise Linux Desktop (v. 5 client) firefox-45.7.0-2.el5_11, firefox-45.7.0-2.el5_11.i386
- Red Hat Enterprise Linux Desktop (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux Server (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux Server (v. 7) firefox-45.7.0-2.el7_3
- Red Hat Enterprise Linux Server Optional (v. 6) firefox-45.7.0-2.el6_8, firefox-45.7.0-2.el6_8.ppc
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-45.7.0-2.el7_3, firefox-45.7.0-2.el7_3.ppc
- Red Hat Enterprise Linux Workstation (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux Workstation (v. 7) firefox-45.7.0-2.el7_3
- Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-45.7.0-2.el6_8
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-45.7.0-2.el7_3
Fixes 9 records
TI-2017-03424 CVE-2017-5396 · GHSA-vq28-pr6f-gpm4
Use after free in Mozilla Thunderbird
Priority MEDIUM 49
A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory.
TI-2017-03418 CVE-2017-5390 · GHSA-75jp-4qgr-vj32
The JSON viewer in the Developer Tools uses insecure methods to create a communication…
Priority MEDIUM 49
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation.
TI-2017-03408 CVE-2017-5380 · GHSA-5xhv-w67w-545f
Use after free in Mozilla Thunderbird
Priority MEDIUM 48
A potential use-after-free found through fuzzing during DOM manipulation of SVG content.
TI-2017-03404 CVE-2017-5376 · GHSA-37qh-mjg8-558v
Use after free in Mozilla Thunderbird
Priority MEDIUM 48
Use-after-free while manipulating XSL in XSLT documents.
TI-2017-03401 CVE-2017-5373 · GHSA-q95x-v9cp-2p83
Memory corruption in Mozilla Thunderbird
Priority MEDIUM 48
Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6.
TI-2017-03406 CVE-2017-5378 · GHSA-hx32-3942-m67q
Information disclosure in Mozilla Thunderbird
Priority LOW 39
Hashed codes of JavaScript objects are shared between pages.
TI-2017-03414 CVE-2017-5386 · GHSA-mjv5-g7c5-w9hq
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web…
Priority LOW 36
WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation in affected extensions.
TI-2017-03411 CVE-2017-5383 · GHSA-qr6h-8c8f-v3mw
Improper input validation in Mozilla Thunderbird
Priority LOW 29
URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar.