Red Hat Security Advisory: firefox security update

Fixed packages 3

Vulnerabilities 5

• High 8.8
  CVE-2019-17026 Exploited Public exploit EPSS 46%

  Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Mar 2, 2020

  KEV Nov 3, 2021
• Unscored —
  CVE-2019-17016

  When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jan 8, 2020
• Unscored —
  CVE-2019-17017

  Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presu…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jan 8, 2020
• Unscored —
  CVE-2019-17022

  When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jan 8, 2020
• Unscored —
  CVE-2019-17024

  Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed ev…

  Mozilla Firefox Firefox ESR thunderbird Browsers Debian Ubuntu Alpine
  Jan 8, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#critical
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1788723
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1788724
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1788726
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1788727
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1789214
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0111.json
• report
  https://access.redhat.com/security/cve/CVE-2019-17016
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17016
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17016
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17016
• report
  https://access.redhat.com/security/cve/CVE-2019-17017
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17017
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17017
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17017
• report
  https://access.redhat.com/security/cve/CVE-2019-17022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17022
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17022
• report
  https://access.redhat.com/security/cve/CVE-2019-17024
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17024
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17024
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/#CVE-2019-17024
• report
  https://access.redhat.com/security/cve/CVE-2019-17026
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17026
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17026
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/#CVE-2019-17026
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog