Red Hat Security AdvisoryRHSA-2023:5426
firefox security update
Released 2023-10-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) firefox-115.3.1-1.el8_2
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) firefox-115.3.1-1.el8_2
Fixes 5 records
Priority CRITICAL 97KEV
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.49013 · Published 2023-09-28 · Partial fix · 117.0.5938.132, 1.13.1 +5 CWE-787
Priority MEDIUM 52
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01388 · Published 2023-09-27 · Partial fix · 118, 115.3 CWE-787
Priority MEDIUM 41
During the worker lifecycle, a use-after-free condition could have occurred, which could have led to a potentially exploitable crash.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00634 · Published 2023-07-12 · Fixed in 115.0.2, 115.0.1 CWE-416
Priority LOW 31
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01116 · Published 2023-09-27 · Partial fix · 118, 115.3 CWE-416
Priority LOW 31
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01095 · Published 2023-09-27 · Partial fix · 118, 115.3 CWE-787
THREATIST.IORead the docs