Red Hat Security AdvisoryRHSA-2024:3953
firefox security update
Released 2024-06-17 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) firefox-115.12.0-1.el8_4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) firefox-115.12.0-1.el8_4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) firefox-115.12.0-1.el8_4
Fixes 7 records
Priority MEDIUM 41
By manipulating the text in an `<input>` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00807 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-787
Priority MEDIUM 40
Memory corruption in the networking stack could have led to a potentially exploitable crash.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00857 · Published 2024-06-11 · Partial fix · 125, 115.12 CWE-416
Priority LOW 39
Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11.
CVSS 3.1HIGH 7.0· Local · No auth · User interaction · EPSS 0.0044 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-786
Priority LOW 39
If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.0107 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-416
Priority LOW 30
Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00578 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-829
Priority LOW 25
By tricking the browser with a `X-Frame-Options` header, a sandboxed iframe could have presented a button that, if clicked by a user, would bypass restrictions to open a new window.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00654 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-693
Priority LOW 23
By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00736 · Published 2024-06-11 · Partial fix · 127, 115.12 CWE-203
THREATIST.IORead the docs