Red Hat Security AdvisoryRHSA-2024:0603
firefox security update
Released 2024-01-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) firefox-115.7.0-1.el9_3, firefox-x11-115.7.0-1.el9_3
Fixes 9 records
Priority MEDIUM 42
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00837 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-451
Priority MEDIUM 41
Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00751 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-94
Priority MEDIUM 41
A malicious devtools extension could have been used to escalate privileges.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00633 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-269
Priority LOW 33
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.02155 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-787
Priority LOW 30
In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00717 · Published 2024-01-23 · Partial fix · 122, 115.7
Priority LOW 30
When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.006 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-693
Priority LOW 30
A Linux user opening the print preview dialog could have caused the browser to crash.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00738 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-416
Priority LOW 21
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00596 · Published 2024-01-23 · Partial fix · 122, 115.7
Priority LOW 20
A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00336 · Published 2024-01-23 · Partial fix · 122, 115.7 CWE-346
THREATIST.IORead the docs