Red Hat Security AdvisoryRHSA-2018:2693
firefox security update
Released 2018-09-12 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux Server (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux Server Optional (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux Workstation (v. 6) firefox-60.2.0-1.el6
- Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-60.2.0-1.el6
Fixes 6 records
Priority MEDIUM 48
A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that is providing payload values to be stored.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03357 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-416
Priority MEDIUM 48
A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown when the timer is deleted while still in use.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03357 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-416
Priority MEDIUM 48
Memory safety bugs present in Firefox 61 and Firefox ESR 60.1.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03146 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-119
Priority LOW 35
Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discover a client IP address via vectors involving a crafted web site that leverages file:// mishandling in…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.03662 · Published 2017-11-04 · Fixed CWE-200
Priority LOW 34
When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash.
CVSS 3.0HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00393 · Published 2018-10-18 · Fixed in 62, 60.2 +1 CWE-787
Priority LOW 31
A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries().
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01093 · Published 2019-02-28 · Partial fix · 62, 60.2 +1 CWE-346
THREATIST.IORead the docs