Red Hat Security Advisory

RHSA-2018:2884

firefox security update

Released 2018-10-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux Server (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux Workstation (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.2.2-1.el7_5
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox-60.2.2-1.el7_5

Fixes 2 records

TI-2018-08887 CVE-2018-12387 · GHSA-vfrp-p8qm-9m8x

Improper input validation in Mozilla Firefox ESR

MEDIUM 51

A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.0959 Published 2018-10-18 Fixed in 60.2.2, 62.0.3 CWE-20

TI-2018-08886 CVE-2018-12386 · GHSA-5vgc-hmw3-287j

Incorrect type conversion in Mozilla Firefox ESR

MEDIUM 50

A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.13524 Published 2018-10-18 Fixed in 60.2.2, 62.0.3 CWE-704