Summary
[128.10.0-1.0.1]
- Updated to 128.10.0 build [Orabug: 37924620]
- Fixes CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 and
- CVE-2025-4093
[128.9.0-2.0.1]
- Update to 128.9.0 build2 [Orabug: 37796786][CVE-2025-3028][CVE-2025-3029]
[CVE-2025-3030]
[128.8.0-1.0.1]
- Update to 128.8.0 build1 [Orabug: 37700882][CVE-2025-1930][CVE-2025-1931]
[CVE-2025-1932][CVE-2025-1933][CVE-2025-1934][CVE-2025-1935][CVE-2025-1936]
[CVE-2025-1937][CVE-2025-1938]
[128.7.0-1.0.1]
- Update to 128.7.0 build1 [Orabug: 37564202][CVE-2025-1009][CVE-2025-1010]
[CVE-2025-1011][CVE-2025-1012][CVE-2025-1013][CVE-2025-1014][CVE-2025-1016]
[CVE-2025-1017]
[128.6.0-1.0.1]
- Update to 128.6.0 build1 [Orabug: 37460830][CVE-2025-0237][CVE-2025-0238]
[CVE-2025-0239][CVE-2025-0240][CVE-2025-0241][CVE-2025-0242][CVE-2025-0243]
- Enable PipeWire camera support for RHEL 10
+ backport upstream fixes for PipeWire camera support
Fixes: RHEL-64749
[128.5.1-1.0.1]
- Update to 128.5.1 [Orabug: 37370369][CVE-2024-11692][CVE-2024-11694]
[CVE-2024-11695][CVE-2024-11696][CVE-2024-11697][CVE-2024-11699]
[128.4.0-1.0.1]
- Update to 128.4.0 build1 [Orabug: 37236498][CVE-2024-10458][CVE-2024-10459]
[CVE-2024-10460][CVE-2024-10461][CVE-2024-10462][CVE-2024-10463]
[CVE-2024-10464][CVE-2024-10465][CVE-2024-10466][CVE-2024-10467]
[128.3.1-2.0.1]
- Update to 128.3.1 [Orabug: 37168934]
[128.3.0-1.0.1]
- Update to 128.3.0 [Orabug: 37139909]
[128.2.0-1.0.1]
- Remove nomerge annotation from abort calls [Orabug: 37079143]
- Update to 128.2.0 [Orabug: 37079143]
[115.12.0-1.0.3]
- Security fixes [Orabug: 36904311][Orabug: 36948200][CVE-2024-6601]
[CVE-2024-6603][CVE-2024-6604][CVE-2024-7519][CVE-2024-7520][CVE-2024-7521]
[CVE-2024-7522][CVE-2024-7524][CVE-2024-7525][CVE-2024-7526][CVE-2024-7527]
[CVE-2024-7529]
[115.12.0-1.0.1]
- Remove upstream references [Orabug: 30143292]
- Update distribution for Oracle Linux [Orabug: 30143292]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
[115.12.0-1]
- Update to 115.12.0 build1
[115.11.0-1]
- Update to 115.11.0 build1
[115.10.0-1]
- Update to 115.10.0 build1
[115.9.1-2]
- Removed expat CVE fix
[115.9.1-1]
- Update to 115.9.1
[115.9.0-2]
- Update to 115.9.0 build2
[115.9.0-1]
- Update to 115.9.0 build1
- Fix expat CVE-2023-52425
[115.8.0-1]
- Update to 115.8.0 build1
[115.7.0-1]
- Update to 115.7.0 build1
[115.6.0-1]
- Update to 115.6.0 build1
[115.5.0-1]
- Update to 115.5.0 build1
[115.4.0-1]
- Update to 115.4.0 build1
- Add fix for CVE-2023-44488
- Set homepage from os-release HOME_URL
[115.3.1-1]
- Update to 115.3.1
[115.3.0-1]
- Update to 115.3.0 ESR
[115.2.0-3]
- Update to 115.2.0 ESR
[115.1.0-1]
- Update to 115.1.0 ESR
[115.0.2-1]
- Update to 115.0.2 ESR
[115.0b8-1]
- Update to 115.0b8
[102.11.0-2]
- Update to 102.11.0 build2
[102.11.0-1]
- Update to 102.11.0 build1
[102.10.0-1]
- Update to 102.10.0 build1
[102.9.0-4]
- Update to 102.9.0 build2
[102.9.0-2]
- removed disable-openh264-download
[102.9.0-1]
- Update to 102.9.0 build1
[102.8.0-2]
- Update to 102.8.0 build2
[102.8.0-1]
- Update to 102.8.0 build1
[102.7.0-1]
- Update to 102.7.0 build1
[102.6.0-2]
- Add firefox-x11 subpackage to allow explicit run of firefox under x11 on RHEL9
[102.6.0-1]
- Update to 102.6.0 build1
[102.5.0-2]
- Added libwebrtc screencast patch for newer features
[102.5.0-1]
- Update to 102.5.0 build1
[102.4.0-1]
- Update to 102.4.0 build1
[102.3.0-7]
- Fix for expat CVE-2022-40674 and non functional webrtc
[102.3.0-6]
- Update to 102.3.0 build1
[91.12.0-1]
- Update to 91.12.0 build1
[91.11.0-2]
- Update to 91.11.0 build2
[91.11.0-1]
- Update to 91.11.0 build1
[91.10.0-1]
- Update to 91.10.0 build1
[91.9.1-1]
- Update to 91.9.1 build1
[91.9.0-1]
- Update to 91.9.0
[91.8.0-1]
- Update to 91.8.0
[91.7.0-3]
- Update to 91.7.0 build3
[91.7.0-2]
- Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315
[91.7.0-1]
- Update to 91.7.0 build2
[91.6.0-2]
- Install langpacks to the browser/extensions to make them available in UI:
rhbz#2030190
[91.6.0-1]
- Update to 91.6.0 build1
[91.5.0-2]
- Use default update channel to fix non working enterprise policies:
rhbz#2044667
[91.5.0-1]
- Update to 91.5.0 build1
[91.4.0-2]
- Added fix for failing addons signatures.
[91.4.0-1]
- Update to 91.4.0 build1
[91.3.0-1]
- Update to 91.3.0 build1
[91.2.0-5]
- Fixed crashes when FIPS is enabled.
[91.2.0-4]
- Disable webrender on the s390x due to wrong colors: rhbz#2009503
[91.2.0-3]
- Update to 91.2.0 build1
[91.1.0-1]
- Update to 91.1.0 build1
* Tue Aug 17 2021 Jan Horak <jhorak@redhat.com>
- Update to 91.0.1 build1
[91.0-1]
- Update to 91.0 ESR
[91.0-1]
- Update to 91.0b8
[78.12.0-2]
- Rebuild to pickup older nss
[78.12.0-1]
- Update to 78.12.0 build1
[78.11.0-3]
- Update to 78.11.0 build2 (release)
[78.11.0-2]
- Fix rhel_minor_version for dist .el8_4 and .el8
[78.11.0-1]
- Update to 78.11.0 build1
[78.10.0-1]
- Update to 78.10.0
[78.9.0-1]
- Update to 78.9.0 build1
[78.8.0-1]
- Update to 78.8.0 build2
[78.7.1-1]
- Update to 78.7.1
[78.7.0-3]
- Fixing install prefix for the homepage
[78.7.0-2]
- Update to 78.7.0 build2
[78.7.0-1]
- Update to 78.7.0 build1
[78.6.1-1]
- Update to 78.6.1 build1
[78.6.0-1]
- Update to 78.6.0 build1
[78.5.0-1]
- Update to 78.5.0 build1
* Tue Nov 10 2020 erack@redhat.com - 78.4.1-1
- Update to 78.4.1
[78.4.0-3]
- Fixing flatpak build, fixing firefox.sh.in to not disable langpacks loading
[78.4.0-2]
- Enable addon sideloading
[78.4.0-1]
- Update to 78.4.0 build2
* Fri Sep 18 2020 Jan Horak <jhorak@redhat.com>
- Update to 78.3.0 build1
[78.2.0-3]
- Update to 78.2.0 build1
* Fri Jul 24 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.11.0 build1
* Fri Jun 26 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.10.0 build1
* Fri May 29 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.9.0 build1
- Added patch for pipewire 0.3
* Mon May 11 2020 Jan Horak <jhorak@redhat.c
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | firefox | 0:128.10.0-1.0.1.el7_9 |
Vulnerabilities 5
-
Critical 9.1
Process isolation bypass using "javascript:" URI links in cross-origin frames
A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerabil…
-
High 8.8
Privilege escalation in Thunderbird Updater
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls,…
-
High 8.1
Memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10
Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.…
-
High 8.1
Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.1…
-
Medium 4.8
Unsafe attribute access during XPath parsing
A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This could lead to out-of-bounds read access and potentially, memory corruption. This vulnerability was fixe…