SCIENTIFIC-LINUX-ERRATA Archives

July 2019

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Critical: firefox on SL7.x x86_64
From:
Scott Reid <[log in to unmask]>
Reply To:
[log in to unmask]
Date:
Thu, 11 Jul 2019 20:06:35 -0000
Content-Type:
text/plain
Parts/Attachments:
text/plain (49 lines) 
Synopsis: Critical: firefox security update

Advisory ID:       SLSA-2019:1763-1

Issue Date:        2019-07-11

CVE Numbers:       CVE-2019-11709

                   CVE-2019-11711

                   CVE-2019-11712

                   CVE-2019-11713

                   CVE-2019-11715

                   CVE-2019-11717

                   CVE-2019-11730

                   CVE-2019-9811

--



This update upgrades Firefox to version 60.8.0 ESR.



Security Fix(es):



* Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8

(CVE-2019-11709)



* Mozilla: Sandbox escape via installation of malicious language pack

(CVE-2019-9811)



* Mozilla: Script injection within domain through inner window reuse

(CVE-2019-11711)



* Mozilla: Cross-origin POST requests can be made with NPAPI plugins by

following 308 redirects (CVE-2019-11712)



* Mozilla: Use-after-free with HTTP/2 cached stream (CVE-2019-11713)



* Mozilla: HTML parsing error can contribute to content XSS

(CVE-2019-11715)



* Mozilla: Caret character improperly escaped in origins (CVE-2019-11717)



* Mozilla: Same-origin policy treats all files in a directory as having

the same-origin (CVE-2019-11730)

--



SL7

  x86_64

    firefox-60.8.0-1.el7_6.x86_64.rpm

    firefox-debuginfo-60.8.0-1.el7_6.x86_64.rpm

    firefox-60.8.0-1.el7_6.i686.rpm

    firefox-debuginfo-60.8.0-1.el7_6.i686.rpm



- Scientific Linux Development Team

ATOM RSS1 RSS2