Red Hat Security Advisory: firefox security update

Fixed packages 6

Vulnerabilities 9

• Unscored —
  CVE-2017-5398

  Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we pr…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5400

  JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potent…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5401

  A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The res…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5402

  A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroy…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5404 Public exploit EPSS 17%

  A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree an…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5405

  Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. Th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5407

  Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract p…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5408

  Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2017-5410

  Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in ho…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429778
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429779
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429780
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429781
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429782
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429783
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429784
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429785
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1429786
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0461.json
• report
  https://access.redhat.com/security/cve/CVE-2017-5398
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5398
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5398
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5398
• report
  https://access.redhat.com/security/cve/CVE-2017-5400
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5400
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5400
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5400
• report
  https://access.redhat.com/security/cve/CVE-2017-5401
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5401
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5401
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5401
• report
  https://access.redhat.com/security/cve/CVE-2017-5402
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5402
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5402
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5402
• report
  https://access.redhat.com/security/cve/CVE-2017-5404
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5404
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5404
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5404
• report
  https://access.redhat.com/security/cve/CVE-2017-5405
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5405
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5405
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2017-06/#CVE-2017-5405
• report
  https://access.redhat.com/security/cve/CVE-2017-5407
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5407
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5407