Red Hat Security AdvisoryRHSA-2019:2729
firefox security update
Released 2019-09-12 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) firefox-60.9.0-1.el7_7
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-60.9.0-1.el7_7
- Red Hat Enterprise Linux Server (v. 7) firefox-60.9.0-1.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-60.9.0-1.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) firefox-60.9.0-1.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-60.9.0-1.el7_7
Fixes 8 records
Priority MEDIUM 45
When a master password is set, it is required to be entered again before stored passwords can be accessed in the 'Saved Logins' dialog.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01411 · Published 2019-09-27 · Fixed in 68.0.2 CWE-287
Priority MEDIUM 43
Given a compromised sandboxed content process due to a separate vulnerability, it is possible to escape that sandbox by loading accounts.firefox.com in that process and forcing a log-in to a malicious Firefox Sync accoun…
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.0151 · Published 2020-01-08 · Partial fix · 60.9, 68.1 +1
Priority MEDIUM 42
It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.02178 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-416
Priority MEDIUM 41
A use-after-free vulnerability can occur while manipulating video elements if the body is freed while still in use.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01713 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-416
Priority MEDIUM 41
Mozilla developers and community members reported memory safety bugs present in Firefox 68, Firefox ESR 68, and Firefox 60.8.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.01643 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-787
Priority LOW 32
A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of SVG filters and a <canvas> element due to an error in how same-origin policy is applied to cached image conte…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01692 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-829
Priority LOW 30
Some HTML elements, such as <title> and <textarea>, can contain literal angle brackets without treating them as markup.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0145 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-79
Priority LOW 21
Navigation events were not fully adhering to the W3C's "Navigation-Timing Level 2" draft specification in some instances for the unload event, which restricts access to detailed timing attributes to only be same-origin.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.01798 · Published 2019-09-27 · Partial fix · 69, 68.1 +1 CWE-203
THREATIST.IORead the docs