Threats affecting pkg:rpm/redhat/firefox

Multiple security vulnerabilities affecting Mozilla Firefox have been addressed in Red Hat Enterprise Linux 7 Extended Lifecycle Support. These include a race condition in permission assignment (CVE-2024-6601), memory safety bugs (CVE-2024-6604), and memory corruption in thread creation (CVE-2024-6603). The update fixes these issues in Firefox version 8 and later.

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 115.11.0 ESR. Security Fix(es): * firefox: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367) * firefox: IndexedDB files retained in private browsing mode (CVE-2024-4767) * firefox: Potential permissions request bypass via clickjacking (CVE-2024-4768) * firefox: Cross-origin responses could be distinguished between script and non-script content-types (CVE-2024-4769) * firefox: Use-after-free could occur when printing to PDF (CVE-2024-4770) * firefox: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11 (CVE-2024-4777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities were addressed in Mozilla Firefox with the release of version 115.10.0 ESR. These include issues such as incorrect Just-In-Time (JIT) compilation leading to use-after-free and wrong object returns, out-of-bounds reads, integer overflow in the OpenType sanitizer, and permission prompt input delay expiration. The update fixes these memory safety and logic errors to improve browser security. The vulnerabilities affect Firefox ESR 115.10.0 and Firefox 125, as well as Thunderbird 115.10. The update is rated as important by Red Hat and is available for Red Hat Enterprise Linux 7 and related distributions.