Red Hat Security Advisory

RHSA-2019:1603

firefox security update

Released 2019-06-25 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux Server (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux Workstation (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.7.2-1.el7_6
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox-60.7.2-1.el7_6

Fixes 2 records

TI-2019-08769 CVE-2019-11708 · GHSA-w2hj-6j62-2w9f

Improper input validation in Mozilla Firefox ESR

CRITICAL 100KEV

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromised child process.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.55874 Published 2019-07-23 Fixed in 60.7.2, 67.0.4 CWE-20

TI-2019-08768 CVE-2019-11707 · GHSA-8ffr-q7j8-h445

Type confusion in Mozilla Firefox ESR

CRITICAL 97KEV

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.37951 Published 2019-07-23 Fixed in 60.7.1, 67.0.3 +1 CWE-843