Red Hat Security Advisory: firefox security update

Fixed packages 3

Vulnerabilities 10

• Unscored —
  CVE-2018-18506

  When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is …

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Alpine
  Feb 5, 2019
• Unscored —
  CVE-2019-9788

  Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thund…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9790

  A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9791 Public exploit EPSS 20%

  The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9792 Public exploit EPSS 13%

  The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script durin…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9793

  A mechanism was discovered that removes some bounds checking for string, array, or typed array accesses if Spectre miti…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9795

  A vulnerability where type-confusion in the IonMonkey just-in-time (JIT) compiler could potentially be used by maliciou…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9796

  A use-after-free vulnerability can occur when the SMIL animation controller incorrectly registers with the refresh driv…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9810 Public exploit EPSS 27%

  Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9813 Public exploit

  Incorrect handling of __proto__ mutations may lead to type confusion in IonMonkey JIT code and can be leveraged for arb…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Apr 26, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690673
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690674
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690675
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690676
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690677
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690678
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690680
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1690681
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1692181
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1692182
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0966.json
• report
  https://access.redhat.com/security/cve/CVE-2018-18506
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18506
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-18506
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2018-18506
• report
  https://access.redhat.com/security/cve/CVE-2019-9788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9788
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9788
• report
  https://access.redhat.com/security/cve/CVE-2019-9790
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9790
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9790
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9790
• report
  https://access.redhat.com/security/cve/CVE-2019-9791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9791
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9791
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9791
• report
  https://access.redhat.com/security/cve/CVE-2019-9792
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9792
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9792
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9792
• report
  https://access.redhat.com/security/cve/CVE-2019-9793
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9793
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9793
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-08/#CVE-2019-9793
• report
  https://access.redhat.com/security/cve/CVE-2019-9795
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9795