Red Hat Security AdvisoryRHSA-2019:0623
firefox security update
Released 2019-03-20 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux Desktop Optional (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux Server (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux Server Optional (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux Workstation (v. 6) firefox-60.6.0-3.el6_10
- Red Hat Enterprise Linux Workstation Optional (v. 6) firefox-60.6.0-3.el6_10
Fixes 8 records
Priority MEDIUM 61
The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just-in-time (JIT) compiler and when the constructor function is…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19915 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-843
Priority MEDIUM 57
The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.13303 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-787
Priority MEDIUM 46
A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driver twice when only a single registration is expected.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0206 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-416
Priority MEDIUM 46
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01853 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-416
Priority MEDIUM 46
Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02244 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-787
Priority MEDIUM 45
A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by malicious JavaScript to trigger a potentially exploitable crash.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01699 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-617
Priority LOW 31
When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to the localhost are to be sent through the p…
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02196 · Published 2019-02-05 · Fixed in 65
Priority LOW 30
A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre mitigations have been disabled.
CVSS 3.0MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.0163 · Published 2019-04-26 · Fixed in 60.6, 66 CWE-119
THREATIST.IORead the docs