Red Hat Security Advisory: firefox security update

Fixed packages 8

Vulnerabilities 6

• Unscored —
  CVE-2017-16541 Public exploit

  Tor Browser before 7.0.9 on macOS and Linux allows remote attackers to bypass the intended anonymity feature and discov…

  thunderbird firefox thunderbird firefox-esr Debian Ubuntu
  Nov 4, 2017
• Unscored —
  CVE-2018-12376

  Memory safety bugs present in Firefox 61 and Firefox ESR 60.1. Some of these bugs showed evidence of memory corruption …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12377

  A use-after-free vulnerability can occur when refresh driver timers are refreshed in some circumstances during shutdown…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12378

  A use-after-free vulnerability can occur when an IndexedDB index is deleted while still in use by JavaScript code that …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Oct 18, 2018
• Unscored —
  CVE-2018-12379

  When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can b…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian
  Oct 18, 2018
• Unscored —
  CVE-2018-18499

  A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu
  Feb 28, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1510816
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625525
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625526
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1625528
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2693.json
• report
  https://access.redhat.com/security/cve/CVE-2017-16541
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-16541
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-16541
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2017-16541
• report
  https://access.redhat.com/security/cve/CVE-2018-12376
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12376
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12376
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12376
• report
  https://access.redhat.com/security/cve/CVE-2018-12377
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12377
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12377
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12377
• report
  https://access.redhat.com/security/cve/CVE-2018-12378
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12378
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12378
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12378
• report
  https://access.redhat.com/security/cve/CVE-2018-12379
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-12379
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-12379
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-12379
• report
  https://access.redhat.com/security/cve/CVE-2018-18499
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1849971
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18499
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-18499
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2018-21/#CVE-2018-18499