Red Hat Security Advisory

RHSA-2024:5323

firefox security update

Released 2024-08-13 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream AUS (v. 8.2) firefox-115.14.0-2.el8_2

Fixes 11 records

TI-2024-06970 CVE-2024-7521 · GHSA-563c-g7mm-g4xp

Improper handling of exceptional conditions in Mozilla Firefox

MEDIUM 50

Incomplete WebAssembly exception handing could have led to a use-after-free.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00616 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-755

TI-2024-06977 CVE-2024-7528 · GHSA-gx25-vx95-m52w

Use after free in Mozilla Firefox

MEDIUM 49

Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00516 Published 2024-08-06 Partial fix · 129, 128.1 CWE-416

TI-2024-06974 CVE-2024-7525 · GHSA-7369-x5q2-rh2m

Improper access control in Mozilla Firefox

MEDIUM 46

It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00598 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-284

TI-2024-06971 CVE-2024-7522 · GHSA-7jrj-xq8x-h553

Out-of-bounds read in Mozilla Firefox

MEDIUM 46

Editor code failed to check an attribute value.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00634 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-125

TI-2024-06968 CVE-2024-7519 · GHSA-9wvx-3hw8-4ghf

Out-of-bounds write in Mozilla Firefox

MEDIUM 44

Insufficient checks when processing graphics shared memory could have led to memory corruption.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00629 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-787

TI-2024-06976 CVE-2024-7527 · GHSA-69x6-6jqx-q847

Use after free in Mozilla Firefox

MEDIUM 41

Unexpected marking work at the start of sweeping could have led to a use-after-free.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00607 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-416

TI-2024-06969 CVE-2024-7520 · GHSA-7j5g-jfh2-w58c

Code injection in Mozilla Firefox

MEDIUM 41

A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00638 Published 2024-08-06 Partial fix · 129, 128.1 CWE-94

TI-2024-06975 CVE-2024-7526 · GHSA-hf5v-h65q-2g27

Use of uninitialized resource in Mozilla Firefox

MEDIUM 40

ANGLE failed to initialize parameters which lead to reading from uninitialized memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0058 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-908

TI-2024-06978 CVE-2024-7529 · GHSA-cr94-c6j4-q6g5

The date picker could partially obscure security prompts.

LOW 38

The date picker could partially obscure security prompts.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00526 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-451

TI-2024-06967 CVE-2024-7518 · GHSA-mcjx-2c4v-mvg9

Clickjacking in Mozilla Firefox

LOW 29

Select options could obscure the fullscreen notification dialog.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00509 Published 2024-08-06 Partial fix · 129, 128.1 CWE-1021

TI-2024-06973 CVE-2024-7524 · GHSA-7m9h-4qg6-4hmh

Cross-site scripting in Mozilla Firefox

LOW 28

Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00489 Published 2024-08-06 Partial fix · 129, 115.14 +1 CWE-79