Red Hat Security AdvisoryRHSA-2018:3005
firefox security and bug fix update
Released 2018-10-24 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux Server (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux Workstation (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.3.0-1.el7_5
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox-60.3.0-1.el7_5
Fixes 7 records
Priority MEDIUM 48
When manipulating user events in nested loops while opening a document through script, it is possible to trigger a potentially exploitable crash due to poor event handling.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03425 · Published 2019-02-28 · Fixed in 63, 60.3
Priority MEDIUM 48
Mozilla developers and community members reported memory safety bugs present in Firefox 62 and Firefox ESR 60.2.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03207 · Published 2019-02-28 · Fixed in 63, 60.3 CWE-119
Priority MEDIUM 43
Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02346 · Published 2019-02-28 · Fixed in 60.3 CWE-119
Priority MEDIUM 40
A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a buffer too small for the conversion.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03924 · Published 2019-02-28 · Fixed in 63, 60.3 CWE-190
Priority LOW 38
By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02851 · Published 2019-02-28 · Fixed in 60.3, 63
Priority LOW 33
A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events.
CVSS 3.0MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02273 · Published 2019-02-28 · Fixed in 60.3, 63 CWE-732
Priority LOW 31
A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user.
CVSS 3.0HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.00371 · Published 2019-02-28 · Fixed in 60.3, 63 CWE-200
THREATIST.IORead the docs