An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 25 September 2019] Previously, this erratum was marked as having a security impact of Critical. This was incorrect; the security impact of this erratum has been changed to Important, to correctly reflect the highest impact rating of CVE fixes included in this release. No changes have been made to the packages.

Mozilla Firefox is an open source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.9.0 ESR.

Security Fix(es) :

* Mozilla: Sandbox escape through Firefox Sync (CVE-2019-9812)

* Mozilla: Memory safety bugs fixed in Firefox 69, Firefox ESR 68.1, and Firefox ESR 60.9 (CVE-2019-11740)

* Mozilla: Same-origin policy violation with SVG filters and canvas to steal cross-origin images (CVE-2019-11742)

* Mozilla: XSS by breaking out of title and textarea elements using innerHTML (CVE-2019-11744)

* Mozilla: Use-after-free while manipulating video (CVE-2019-11746)

* Mozilla: Use-after-free while extracting a key value in IndexedDB (CVE-2019-11752)

* firefox: stored passwords in 'Saved Logins' can be copied without master password entry (CVE-2019-11733)

* Mozilla: Cross-origin access to unload event attributes (CVE-2019-11743)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2019-2773 advisory.

    [60.9.0-1.0.1]
    - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js

    [60.9.0-1]
    - Update to 60.9.0

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-30 advisory.

  - It is possible to delete an IndexedDB key value and subsequently try to extract it during conversion. This     results in a use-after-free and a potentially exploitable crash. (CVE-2019-11752)

  - Encrypted S/MIME parts in a crafted multipart/alternative message can leak plaintext when included in a a     HTML reply/forward. (CVE-2019-11739)

  - A use-after-free vulnerability can occur while manipulating video elements if the body is freed while     still in use. This results in a potentially exploitable crash. (CVE-2019-11746)

  - Some HTML elements, such as <code><title></code> and <code><textarea></code>, can contain     literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to     <code>.innerHTML</code> on these elements, and subsequent content after that will be parsed as if it were     outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements     as it does for other elements. (CVE-2019-11744)

  - A same-origin policy violation occurs allowing the theft of cross-origin images through a combination of     SVG filters and a <code><canvas></code> element due to an error in how same-origin policy is applied     to cached image content. The resulting same-origin policy violation could allow for data theft.
    (CVE-2019-11742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
128976	CentOS 6 : firefox (CESA-2019:2694)	Nessus	CentOS Local Security Checks	2019/9/18	2024/4/24	critical
128961	Oracle Linux 7 : thunderbird (ELSA-2019-2773)	Nessus	Oracle Linux Local Security Checks	2019/9/17	2024/10/22	high
128971	Mozilla Thunderbird < 68.1	Nessus	MacOS X Local Security Checks	2019/9/18	2025/11/18	high
147407	NewStart CGSL MAIN 4.06 : firefox Multiple Vulnerabilities (NS-SA-2021-0004)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2023/4/25	critical

検出

プラグインの検索

critical

high

high

critical