Synopsis

Critical: firefox security update

Type/Severity

Security Advisory: Critical

Topic

An update for firefox is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.7.0 ESR.

Security Fix(es):

• Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5125)
  
• Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07) (CVE-2018-5127)
  
• Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07) (CVE-2018-5129)
  
• Mozilla: Mismatched RTP payload type can trigger memory corruption (MFSA 2018-07) (CVE-2018-5130)
  
• Mozilla: Fetch API improperly returns cached copies of no-store/no-cache resources (MFSA 2018-07) (CVE-2018-5131)
  
• Mozilla: Integer overflow during Unicode conversion (MFSA 2018-07) (CVE-2018-5144)
  
• Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 (MFSA 2018-07) (CVE-2018-5145)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64

Fixes

• BZ - 1555127 - CVE-2018-5125 Mozilla: Memory safety bugs fixed in Firefox 59 and Firefox ESR 52.7 (MFSA 2018-07)
• BZ - 1555128 - CVE-2018-5127 Mozilla: Buffer overflow manipulating SVG animatedPathSegList (MFSA 2018-07)
• BZ - 1555129 - CVE-2018-5129 Mozilla: Out-of-bounds write with malformed IPC messages (MFSA 2018-07)
• BZ - 1555130 - CVE-2018-5130 Mozilla: Mismatched RTP payload type can trigger memory corruption (MFSA 2018-07)
• BZ - 1555131 - CVE-2018-5131 Mozilla: Fetch API improperly returns cached copies of no-store/no-cache resources (MFSA 2018-07)
• BZ - 1555132 - CVE-2018-5144 Mozilla: Integer overflow during Unicode conversion (MFSA 2018-07)
• BZ - 1555133 - CVE-2018-5145 Mozilla: Memory safety bugs fixed in Firefox ESR 52.7 (MFSA 2018-07)

CVEs

• CVE-2018-5125
• CVE-2018-5127
• CVE-2018-5129
• CVE-2018-5130
• CVE-2018-5131
• CVE-2018-5144
• CVE-2018-5145

References

• https://access.redhat.com/security/updates/classification/#critical
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-07/

Red Hat Enterprise Linux Server 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
x86_64
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-52.7.0-1.el6_9.x86_64.rpm	SHA-256: c387a697727ce8053a55faa5b34b20ffa23b6690c6cde49f524ae57a40895653
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf
firefox-debuginfo-52.7.0-1.el6_9.x86_64.rpm	SHA-256: ce378b045f9832383d1a7a443b93ded0cd1f75ca553dd249801530da0926b0ba
i386
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf

Red Hat Enterprise Linux Workstation 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
x86_64
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-52.7.0-1.el6_9.x86_64.rpm	SHA-256: c387a697727ce8053a55faa5b34b20ffa23b6690c6cde49f524ae57a40895653
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf
firefox-debuginfo-52.7.0-1.el6_9.x86_64.rpm	SHA-256: ce378b045f9832383d1a7a443b93ded0cd1f75ca553dd249801530da0926b0ba
i386
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf

Red Hat Enterprise Linux Desktop 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
x86_64
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-52.7.0-1.el6_9.x86_64.rpm	SHA-256: c387a697727ce8053a55faa5b34b20ffa23b6690c6cde49f524ae57a40895653
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf
firefox-debuginfo-52.7.0-1.el6_9.x86_64.rpm	SHA-256: ce378b045f9832383d1a7a443b93ded0cd1f75ca553dd249801530da0926b0ba
i386
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf

Red Hat Enterprise Linux for IBM z Systems 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
s390x
firefox-52.7.0-1.el6_9.s390.rpm	SHA-256: 7316a739e05e0e06ace2e2e2bcf37832c843d4498968adeac8c6dae1c0cbd475
firefox-52.7.0-1.el6_9.s390x.rpm	SHA-256: 172b2441b4040ff4c3e477d94dab775f2d099a708e82c80f403f6c71b2ddb2cb
firefox-debuginfo-52.7.0-1.el6_9.s390.rpm	SHA-256: 227a3d4b902a88d362896064aa1843c7615d9ddee488f79fe8af8f5cc90b0170
firefox-debuginfo-52.7.0-1.el6_9.s390x.rpm	SHA-256: 2bdfa8ac31561147dae06d5c63e14a9a9d00f5f02aec703a155ce7c476c2613e

Red Hat Enterprise Linux for Power, big endian 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
ppc64
firefox-52.7.0-1.el6_9.ppc.rpm	SHA-256: e14324abb96864918c3de5da84803fc78890fcde3683e2011b6a93e7f573e2fe
firefox-52.7.0-1.el6_9.ppc64.rpm	SHA-256: 198b0b72009a67a82db788e306789e5695e5f259eec30967ba7402180ee1397f
firefox-debuginfo-52.7.0-1.el6_9.ppc.rpm	SHA-256: 4d051ad3ab8c8d44abbccb718b8014aeadc86dcb55881d3204c85e588aa3b88c
firefox-debuginfo-52.7.0-1.el6_9.ppc64.rpm	SHA-256: bc3b20f531ff3d0fa9c55897a63cc7fa7f6543e75d91bb1aa120ed6acee31d6a

Red Hat Enterprise Linux for Scientific Computing 6

SRPM
firefox-52.7.0-1.el6_9.src.rpm	SHA-256: 7663325be13e4db3266be159ce01d3155f0a23ee302084bc3389595663496e47
x86_64
firefox-52.7.0-1.el6_9.i686.rpm	SHA-256: 8453d1ab1fb895fe629f6d1ab8af261530768f9a36646c3bd43585305b62c62f
firefox-52.7.0-1.el6_9.x86_64.rpm	SHA-256: c387a697727ce8053a55faa5b34b20ffa23b6690c6cde49f524ae57a40895653
firefox-debuginfo-52.7.0-1.el6_9.i686.rpm	SHA-256: 08c21ab2037158c3225e634a6dec28347523fcb09acd2f343b9c15cd52553cdf
firefox-debuginfo-52.7.0-1.el6_9.x86_64.rpm	SHA-256: ce378b045f9832383d1a7a443b93ded0cd1f75ca553dd249801530da0926b0ba