[RHSA-2024:0012] firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 115.6.0 ESR.
Security Fix(es):
Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver (CVE-2023-6856)
Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 (CVE-2023-6864)
Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code> (CVE-2023-6865)
Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)
Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)
Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)
Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation (CVE-2023-6860)
Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode (CVE-2023-6861)
Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)
Mozilla: Clickjacking permission prompts using the popup transition (CVE-2023-6867)
Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Package | Affected Version |
---|---|
pkg:rpm/redhat/firefox?arch=x86_64&distro=redhat-8.9 | < 115.6.0-1.el8_9 |
pkg:rpm/redhat/firefox?arch=s390x&distro=redhat-8.9 | < 115.6.0-1.el8_9 |
pkg:rpm/redhat/firefox?arch=ppc64le&distro=redhat-8.9 | < 115.6.0-1.el8_9 |
pkg:rpm/redhat/firefox?arch=aarch64&distro=redhat-8.9 | < 115.6.0-1.el8_9 |
- ID
- RHSA-2024:0012
- Severity
- important
- URL
- https://access.redhat.com/errata/RHSA-2024:0012
- Published
-
2024-01-02T00:00:00
(8 months ago) - Modified
-
2024-01-02T00:00:00
(8 months ago) - Rights
- Copyright 2024 Red Hat, Inc.
- Other Advisories
-
- ALAS2-2024-2377
- ALPINE:CVE-2023-6856
- ALPINE:CVE-2023-6857
- ALPINE:CVE-2023-6858
- ALPINE:CVE-2023-6859
- ALPINE:CVE-2023-6860
- ALPINE:CVE-2023-6861
- ALPINE:CVE-2023-6862
- ALPINE:CVE-2023-6863
- ALPINE:CVE-2023-6864
- ALPINE:CVE-2023-6865
- ALPINE:CVE-2023-6867
- ALSA-2024:0001
- ALSA-2024:0003
- ALSA-2024:0012
- ALSA-2024:0025
- DSA-5581-1
- DSA-5582-1
- ELSA-2024-0001
- ELSA-2024-0003
- ELSA-2024-0012
- ELSA-2024-0025
- ELSA-2024-0026
- ELSA-2024-0027
- GLSA-202401-10
- GLSA-202402-25
- MFSA-2023-54
- MFSA-2023-55
- MFSA-2023-56
- RHSA-2024:0001
- RHSA-2024:0003
- RHSA-2024:0025
- RHSA-2024:0026
- RHSA-2024:0027
- RLSA-2024:0003
- RLSA-2024:0012
- SSA:2023-353-02
- SSA:2023-353-03
- SUSE-SU-2023:4912-1
- SUSE-SU-2023:4928-1
- SUSE-SU-2023:4929-1
- SUSE-SU-2024:0044-1
- USN-6562-1
- USN-6563-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/redhat/firefox?arch=x86_64&distro=redhat-8.9 | redhat | firefox | < 115.6.0-1.el8_9 | redhat-8.9 | x86_64 | |
Affected | pkg:rpm/redhat/firefox?arch=s390x&distro=redhat-8.9 | redhat | firefox | < 115.6.0-1.el8_9 | redhat-8.9 | s390x | |
Affected | pkg:rpm/redhat/firefox?arch=ppc64le&distro=redhat-8.9 | redhat | firefox | < 115.6.0-1.el8_9 | redhat-8.9 | ppc64le | |
Affected | pkg:rpm/redhat/firefox?arch=aarch64&distro=redhat-8.9 | redhat | firefox | < 115.6.0-1.el8_9 | redhat-8.9 | aarch64 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |