Red Hat Security AdvisoryRHSA-2018:1414
firefox security update
Released 2018-05-14 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) firefox-52.8.0-1.el6_9
- Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-52.8.0-1.el6_9
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-52.8.0-1.el6_9
- Red Hat Enterprise Linux Server (v. 6) firefox-52.8.0-1.el6_9
- Red Hat Enterprise Linux Server Optional (v. 6) firefox-52.8.0-1.el6_9, firefox-52.8.0-1.el6_9.ppc
- Red Hat Enterprise Linux Workstation (v. 6) firefox-52.8.0-1.el6_9
- Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-52.8.0-1.el6_9
Fixes 9 records
Priority MEDIUM 61
An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks, resulting in possible out-of-bounds writes.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.20641 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-190
Priority MEDIUM 51
The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.10285 · Published 2018-06-11 · Fixed in 52.8, 60 +2 CWE-94
Priority MEDIUM 48
Mozilla developers backported selected changes in the Skia library.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03172 · Published 2018-06-11 · Fixed in 52.8 CWE-119
Priority MEDIUM 48
A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03379 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-416
Priority MEDIUM 48
A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03194 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-416
Priority MEDIUM 48
Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03086 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-119
Priority MEDIUM 43
A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data.
CVSS 3.0HIGH 8.1· Network · No auth · No interaction · EPSS 0.04893 · Published 2018-06-11 · Fixed in 52.8 CWE-119
Priority LOW 36
Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01583 · Published 2018-06-11 · Fixed in 52.8, 60 CWE-200
Priority LOW 29
Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element.
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.02332 · Published 2018-06-11 · Fixed in 52.8, 60
THREATIST.IORead the docs