Synopsis

Critical: firefox security update

Type/Severity

Security Advisory: Critical

Topic

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.2.0 ESR.

Security Fix(es):

• Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2 (CVE-2018-12376)
  
• Mozilla: Use-after-free in driver timers (CVE-2018-12377)
  
• Mozilla: Use-after-free in IndexedDB (CVE-2018-12378)
  
• Mozilla: Proxy bypass using automount and autofs (CVE-2017-16541)
  
• Mozilla: Out-of-bounds write with malicious MAR file (CVE-2018-12379)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Alex Gaynor, Boris Zbarsky, Christoph Diehl, Christian Holler, Jason Kratzer, Jed Davis, Tyson Smith, Bogdan Tara, Karl Tomlinson, Mats Palmgren, Nika Layzell, Ted Campbell, Nils, Zhanjia Song, and Holger Fuhrmannek as the original reporters.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

• BZ - 1510816 - CVE-2017-16541 Mozilla: Proxy bypass using automount and autofs
• BZ - 1625525 - CVE-2018-12376 Mozilla: Memory safety bugs fixed in Firefox 62 and Firefox ESR 60.2
• BZ - 1625526 - CVE-2018-12377 Mozilla: Use-after-free in driver timers
• BZ - 1625527 - CVE-2018-12378 Mozilla: Use-after-free in IndexedDB
• BZ - 1625528 - CVE-2018-12379 Mozilla: Out-of-bounds write with malicious MAR file

CVEs

• CVE-2017-16541
• CVE-2018-12376
• CVE-2018-12377
• CVE-2018-12378
• CVE-2018-12379

References

• https://access.redhat.com/security/updates/classification/#critical
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-20/

Red Hat Enterprise Linux Server 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux Server - Extended Update Support 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux Server - Extended Update Support 7.5

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux Server - AUS 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux Workstation 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux Desktop 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
s390x
firefox-60.2.0-1.el7_5.s390x.rpm	SHA-256: bf58d6979df579df1120fe437aaf0966e4e185fd69085849f5625b45aaccfec3
firefox-debuginfo-60.2.0-1.el7_5.s390x.rpm	SHA-256: b72536e4b01aefba67022b87743f1c01c55d1f8ef8070225da364b476f563b88

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
s390x
firefox-60.2.0-1.el7_5.s390x.rpm	SHA-256: bf58d6979df579df1120fe437aaf0966e4e185fd69085849f5625b45aaccfec3
firefox-debuginfo-60.2.0-1.el7_5.s390x.rpm	SHA-256: b72536e4b01aefba67022b87743f1c01c55d1f8ef8070225da364b476f563b88

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
s390x
firefox-60.2.0-1.el7_5.s390x.rpm	SHA-256: bf58d6979df579df1120fe437aaf0966e4e185fd69085849f5625b45aaccfec3
firefox-debuginfo-60.2.0-1.el7_5.s390x.rpm	SHA-256: b72536e4b01aefba67022b87743f1c01c55d1f8ef8070225da364b476f563b88

Red Hat Enterprise Linux for Power, big endian 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64
firefox-60.2.0-1.el7_5.ppc64.rpm	SHA-256: 0c578aef3bfe0006f57beedf54bb2b3348322ab6b285f5a7e8daceb3c85b2c55
firefox-debuginfo-60.2.0-1.el7_5.ppc64.rpm	SHA-256: e1dadac174c1839f0de80ca2a4743ea3adcdebfa125afd11d6734e2dcbcb8a0b

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64
firefox-60.2.0-1.el7_5.ppc64.rpm	SHA-256: 0c578aef3bfe0006f57beedf54bb2b3348322ab6b285f5a7e8daceb3c85b2c55
firefox-debuginfo-60.2.0-1.el7_5.ppc64.rpm	SHA-256: e1dadac174c1839f0de80ca2a4743ea3adcdebfa125afd11d6734e2dcbcb8a0b

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64
firefox-60.2.0-1.el7_5.ppc64.rpm	SHA-256: 0c578aef3bfe0006f57beedf54bb2b3348322ab6b285f5a7e8daceb3c85b2c55
firefox-debuginfo-60.2.0-1.el7_5.ppc64.rpm	SHA-256: e1dadac174c1839f0de80ca2a4743ea3adcdebfa125afd11d6734e2dcbcb8a0b

Red Hat Enterprise Linux for Power, little endian 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64le
firefox-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: a84eb4601037a4406d0abb566a5216cf6ebca70efe978cf5cb2aa1fd0ef36506
firefox-debuginfo-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: 14047af4304be2fc9ef02126f580643e822945a98ad009562fa8bd7ce1530a57

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64le
firefox-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: a84eb4601037a4406d0abb566a5216cf6ebca70efe978cf5cb2aa1fd0ef36506
firefox-debuginfo-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: 14047af4304be2fc9ef02126f580643e822945a98ad009562fa8bd7ce1530a57

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64le
firefox-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: a84eb4601037a4406d0abb566a5216cf6ebca70efe978cf5cb2aa1fd0ef36506
firefox-debuginfo-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: 14047af4304be2fc9ef02126f580643e822945a98ad009562fa8bd7ce1530a57

Red Hat Enterprise Linux Server - TUS 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux for ARM 64 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
aarch64
firefox-60.2.0-1.el7_5.aarch64.rpm	SHA-256: 9d3f1171071e663bbe8ed5c50506aeba58da32f9c76a85fd3b48ce9db400b1ac
firefox-debuginfo-60.2.0-1.el7_5.aarch64.rpm	SHA-256: 8b0d0f74889f461b2b399aacf5bd4f20a6d2947863c346eec4f8abf3f87786f7

Red Hat Enterprise Linux for Power 9 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64le
firefox-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: a84eb4601037a4406d0abb566a5216cf6ebca70efe978cf5cb2aa1fd0ef36506
firefox-debuginfo-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: 14047af4304be2fc9ef02126f580643e822945a98ad009562fa8bd7ce1530a57

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
ppc64le
firefox-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: a84eb4601037a4406d0abb566a5216cf6ebca70efe978cf5cb2aa1fd0ef36506
firefox-debuginfo-60.2.0-1.el7_5.ppc64le.rpm	SHA-256: 14047af4304be2fc9ef02126f580643e822945a98ad009562fa8bd7ce1530a57

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
x86_64
firefox-60.2.0-1.el7_5.i686.rpm	SHA-256: da56a91e52b93eed8b140e2be2626275adc1faa92a1fe7ebb93cd2104c7585ea
firefox-60.2.0-1.el7_5.x86_64.rpm	SHA-256: 52bd39686ed7f39ae650c6b0d3a0d2524bc355276511fbbf09ecfba1f62d69fa
firefox-debuginfo-60.2.0-1.el7_5.i686.rpm	SHA-256: dd636b3776229feb8136f766bf8a47ccb559f98c12fe11cc3161b58600e282e1
firefox-debuginfo-60.2.0-1.el7_5.x86_64.rpm	SHA-256: c84ec07b58e04de2e589e06848058f0d48a8ae042d52590aa754e61ddd38406f

Red Hat Enterprise Linux for IBM System z (Structure A) 7

SRPM
firefox-60.2.0-1.el7_5.src.rpm	SHA-256: 63f853876a38d5909725c16abc54caa611a994a5df8e891e33a00e4848c55610
s390x
firefox-60.2.0-1.el7_5.s390x.rpm	SHA-256: bf58d6979df579df1120fe437aaf0966e4e185fd69085849f5625b45aaccfec3
firefox-debuginfo-60.2.0-1.el7_5.s390x.rpm	SHA-256: b72536e4b01aefba67022b87743f1c01c55d1f8ef8070225da364b476f563b88