Red Hat Security Advisory: firefox security update

Fixed packages 8

Vulnerabilities 9

• High 8.8
  CVE-2018-5158 Public exploit EPSS 10%

  Malicious PDF can inject JavaScript into PDF Viewer

  The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file. This JavaScript can then be run with the permissions of the PDF viewer by its worker. This vulnerability af…

  Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu npm
  Jun 11, 2018
• Unscored —
  CVE-2018-5150

  Memory safety bugs were reported in Firefox 59, Firefox ESR 52.7, and Thunderbird 52.7. Some of these bugs showed evide…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5154

  A use-after-free vulnerability can occur while enumerating attributes during SVG animations with clip paths. This resul…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5155

  A use-after-free vulnerability can occur while adjusting layout during SVG animations with text paths. This results in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5157

  Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for t…

  Mozilla Firefox Firefox ESR firefox Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5159 Public exploit EPSS 21%

  An integer overflow can occur in the Skia library due to 32-bit integer use in an array without integer overflow checks…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5168

  Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5178

  A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of …

  Mozilla Thunderbird Firefox ESR Thunderbird ESR Browsers Debian Ubuntu
  Jun 11, 2018
• Unscored —
  CVE-2018-5183

  Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues incl…

  Mozilla Thunderbird Firefox ESR Thunderbird ESR Browsers Debian Ubuntu
  Jun 11, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-11/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576255
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576257
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576258
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576259
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576260
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576269
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576278
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1576283
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1414.json
• report
  https://access.redhat.com/security/cve/CVE-2018-5150
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5150
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5150
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5150
• report
  https://access.redhat.com/security/cve/CVE-2018-5154
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5154
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5154
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5154
• report
  https://access.redhat.com/security/cve/CVE-2018-5155
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5155
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5155
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5155
• report
  https://access.redhat.com/security/cve/CVE-2018-5157
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5157
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5157
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5157
• report
  https://access.redhat.com/security/cve/CVE-2018-5158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5158
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5158
• report
  https://access.redhat.com/security/cve/CVE-2018-5159
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5159
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5159
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-12/#CVE-2018-5159
• report
  https://access.redhat.com/security/cve/CVE-2018-5168
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-5168
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-5168