Red Hat Security Advisory: firefox security update

Fixed packages 8

Vulnerabilities 13

• Medium 5.3
  CVE-2019-7317

  png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called un…

  thunderbird firefox thunderbird firefox-esr Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 4, 2019
• Unscored —
  CVE-2018-18511

  Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImag…

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-11691

  A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-11692

  A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use,…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-11693

  The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-11698

  If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-5798

  Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an …

  Google Chrome chromium chromium-browser Browsers Debian Ubuntu Alpine
  May 23, 2019
• Unscored —
  CVE-2019-9797

  Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBit…

  Mozilla Firefox thunderbird mozjs38 Browsers Debian Ubuntu Alpine
  Apr 26, 2019
• Unscored —
  CVE-2019-9800

  Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thund…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-9816 Public exploit

  A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, a…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-9817

  Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal ima…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-9819

  A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a pote…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019
• Unscored —
  CVE-2019-9820

  A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Jul 23, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1672409
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1676997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1688200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712617
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712618
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712619
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712621
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712622
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712623
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712628
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1712629
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1267.json
• report
  https://access.redhat.com/security/cve/CVE-2018-18511
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-18511
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-18511
• report
  https://access.redhat.com/security/cve/CVE-2019-5798
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-5798
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-5798
• article
  https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html
• report
  https://access.redhat.com/security/cve/CVE-2019-7317
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-7317
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-7317
• report
  https://access.redhat.com/security/cve/CVE-2019-9797
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9797
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9797
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797
• report
  https://access.redhat.com/security/cve/CVE-2019-9800
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9800
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9800
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800
• report
  https://access.redhat.com/security/cve/CVE-2019-9816
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9816
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9816
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816
• report
  https://access.redhat.com/security/cve/CVE-2019-9817