Red Hat Security Advisory

RHSA-2018:2835

firefox security update

Released 2018-09-27 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux Server (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux Workstation (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.2.1-1.el7_5
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox-60.2.1-1.el7_5

Fixes 2 records

TI-2018-08885 CVE-2018-12385 · GHSA-w434-f353-fv6q

Improper input validation in Mozilla Thunderbird

LOW 31

A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory.

CVSS 3.0HIGH 7.0 Local Low privileges No interaction EPSS 0.00358 Published 2018-10-18 Fixed in 60.2.1, 62.0.2 CWE-20

TI-2018-08883 CVE-2018-12383 · GHSA-cvcq-m8cv-7r6g

Insufficiently protected credentials in Mozilla Firefox

LOW 25

If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0046 Published 2018-10-18 Partial fix · 62, 60.2.1 CWE-522