RHSA-2016:0373 — Red Hat Security Advisory: firefox security update

Fixed packages 18

Release	Package	Fixed in
Red Hat · RHEL 5 enterprise_linux:5::client	firefox	0:38.7.0-1.el5_11
Red Hat · RHEL 5 enterprise_linux:5::client	firefox-debuginfo	0:38.7.0-1.el5_11
Red Hat · RHEL 5 enterprise_linux:5::server	firefox	0:38.7.0-1.el5_11
Red Hat · RHEL 5 enterprise_linux:5::server	firefox-debuginfo	0:38.7.0-1.el5_11
Red Hat · RHEL 6 enterprise_linux:6::client	firefox	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::client	firefox-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::computenode	firefox	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::computenode	firefox-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::server	firefox	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::server	firefox-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::workstation	firefox	0:38.7.0-1.el6_7
Red Hat · RHEL 6 enterprise_linux:6::workstation	firefox-debuginfo	0:38.7.0-1.el6_7
Red Hat · RHEL 7 enterprise_linux:7::client	firefox	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client	firefox-debuginfo	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	firefox	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server	firefox-debuginfo	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	firefox	0:38.7.0-1.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation	firefox-debuginfo	0:38.7.0-1.el7_2

Vulnerabilities 26

Unscored —

CVE-2016-1952

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 3…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1954

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1957

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers t…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1958

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers…

firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1960 Public exploit EPSS 31%

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1961

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1962

Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and F…

firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1964

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x befor…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1965

Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the origin…

firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1966

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Fire…

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1973

Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allo…

firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1974

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not …

thunderbird firefox firefox-esr Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-1977

The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2790

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Fi…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2791

The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2792

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2793

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, all…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2794

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox bef…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2795

The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and F…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2796

Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2797

The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2798

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 a…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2799

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Fire…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2800

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2801

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Fir…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016
Unscored —

CVE-2016-2802

The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox befo…

thunderbird firefox firefox-esr graphite2 Debian Ubuntu

Mar 13, 2016

References

article
https://access.redhat.com/security/updates/classification/#critical
article
https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr38.7
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315566
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315569
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315573
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315574
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315576
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315577
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315578
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315774
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315775
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315778
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315782
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315785
report
https://bugzilla.redhat.com/show_bug.cgi?id=1315795
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0373.json
report
https://access.redhat.com/security/cve/CVE-2016-1952
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1952
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1952
article
https://www.mozilla.org/security/announce/2016/mfsa2016-16.html
report
https://access.redhat.com/security/cve/CVE-2016-1954
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1954
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1954
article
https://www.mozilla.org/security/announce/2016/mfsa2016-17.html
report
https://access.redhat.com/security/cve/CVE-2016-1957
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1957
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1957
article
https://www.mozilla.org/security/announce/2016/mfsa2016-20.html
report
https://access.redhat.com/security/cve/CVE-2016-1958
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1958
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1958
article
https://www.mozilla.org/security/announce/2016/mfsa2016-21.html
report
https://access.redhat.com/security/cve/CVE-2016-1960
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1960
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1960
article
https://www.mozilla.org/security/announce/2016/mfsa2016-23.html
report
https://access.redhat.com/security/cve/CVE-2016-1961
advisory
https://www.cve.org/CVERecord?id=CVE-2016-1961
advisory
https://nvd.nist.gov/vuln/detail/CVE-2016-1961

Red Hat Security Advisory: firefox security update

Fixed packages 18

Vulnerabilities 26

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 3…

The nsCSPContext::SendReports function in dom/security/nsCSPContext.cpp in Mozilla Firefox before 45.0 and Firefox ESR …

Memory leak in libstagefright in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers t…

browser/base/content/browser.js in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers…

Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox…

Use-after-free vulnerability in the nsHTMLDocument::SetBody function in dom/html/nsHTMLDocument.cpp in Mozilla Firefox …

Use-after-free vulnerability in the mozilla::DataChannelConnection::Close function in Mozilla Firefox before 45.0 and F…

Use-after-free vulnerability in the AtomicBaseIncDec function in Mozilla Firefox before 45.0 and Firefox ESR 38.x befor…

Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 mishandle a navigation sequence that returns to the origin…

The nsNPObjWrapper::GetNewOrUsed function in dom/plugins/base/nsJSNPRuntime.cpp in Mozilla Firefox before 45.0 and Fire…

Race condition in the GetStaticInstance function in the WebRTC implementation in Mozilla Firefox before 45.0 might allo…

The nsScannerString::AppendUnicodeTo function in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 does not …

The Machine::Code::decoder::analysis::set_ref function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45…

The graphite2::TtfUtil::GetTableInfo function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Fi…

The graphite2::GlyphCache::glyph function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefo…

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

CachedCmap.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, all…

The graphite2::TtfUtil::CmapSubtable12NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox bef…

The graphite2::FileFace::get_table_fn function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and F…

Heap-based buffer overflow in the graphite2::vm::Machine::Code::Code function in Graphite 2 before 1.3.6, as used in Mo…

The graphite2::TtfUtil::CmapSubtable12Lookup function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.…

The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 a…

Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Fire…

The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 an…

The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Fir…

The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox befo…

References