RHSA-2017:2456 — Red Hat Security Advisory: firefox security update

Fixed packages 14

Release	Package	Fixed in
Red Hat · RHEL 6 enterprise_linux:6::client	firefox	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::client	firefox-debuginfo	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode	firefox	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::computenode	firefox-debuginfo	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server	firefox	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::server	firefox-debuginfo	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation	firefox	0:52.3.0-3.el6_9
Red Hat · RHEL 6 enterprise_linux:6::workstation	firefox-debuginfo	0:52.3.0-3.el6_9
Red Hat · RHEL 7 enterprise_linux:7::client	firefox	0:52.3.0-2.el7_4
Red Hat · RHEL 7 enterprise_linux:7::client	firefox-debuginfo	0:52.3.0-2.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server	firefox	0:52.3.0-2.el7_4
Red Hat · RHEL 7 enterprise_linux:7::server	firefox-debuginfo	0:52.3.0-2.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation	firefox	0:52.3.0-2.el7_4
Red Hat · RHEL 7 enterprise_linux:7::workstation	firefox-debuginfo	0:52.3.0-2.el7_4

Vulnerabilities 15

Unscored —

CVE-2017-7753

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style dat…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7779

Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evide…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7784

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer …

thunderbird mozjs38 firefox firefox-esr Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7785

A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. T…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7786

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a p…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7787

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7791

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7792

A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7798

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page sou…

Mozilla Firefox Firefox ESR mozjs38 Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7800

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disco…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7801

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7802

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If thes…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7803

When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This r…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7807

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the d…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
Unscored —

CVE-2017-7809

A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while sti…

thunderbird firefox firefox-esr Debian Ubuntu

Jun 11, 2018

References

article
https://access.redhat.com/security/updates/classification/#critical
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479188
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479191
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479201
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479203
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479205
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479206
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479209
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479210
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479213
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479218
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479223
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479224
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479225
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479227
report
https://bugzilla.redhat.com/show_bug.cgi?id=1479650
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2456.json
report
https://access.redhat.com/security/cve/CVE-2017-7753
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7753
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7753
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/#CVE-2017-7753
report
https://access.redhat.com/security/cve/CVE-2017-7779
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7779
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7779
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/#CVE-2017-7779
report
https://access.redhat.com/security/cve/CVE-2017-7784
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7784
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7784
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/#CVE-2017-7784
report
https://access.redhat.com/security/cve/CVE-2017-7785
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7785
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7785
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/#CVE-2017-7785
report
https://access.redhat.com/security/cve/CVE-2017-7786
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7786
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7786
article
https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/#CVE-2017-7786
report
https://access.redhat.com/security/cve/CVE-2017-7787

Red Hat Security Advisory: firefox security update

Fixed packages 14

Vulnerabilities 15

An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style dat…

Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evide…

A use-after-free vulnerability can occur when reading an image observer during frame reconstruction after the observer …

A buffer overflow can occur when manipulating Accessible Rich Internet Applications (ARIA) attributes within the DOM. T…

A buffer overflow can occur when the image renderer attempts to paint non-displayable SVG elements. This results in a p…

Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes…

On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary…

A buffer overflow will occur when viewing a certificate in the certificate manager if the certificate has an extremely …

The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page sou…

A use-after-free vulnerability can occur in WebSockets when the object holding the connection is freed before the disco…

A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where…

A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If thes…

When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored. This r…

A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the d…

A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while sti…

References