Synopsis

Critical: firefox security update

Type/Severity

Security Advisory: Critical

Topic

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 60.7.2 ESR.

Security Fix(es):

• Mozilla: Type confusion in Array.pop (CVE-2019-11707)
  
• Mozilla: Sandbox escape using Prompt:Open (CVE-2019-11708)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0 x86_64

Fixes

• BZ - 1721789 - CVE-2019-11707 Mozilla: Type confusion in Array.pop
• BZ - 1722673 - CVE-2019-11708 Mozilla: Sandbox escape using Prompt:Open

CVEs

• CVE-2019-11707
• CVE-2019-11708

References

• https://access.redhat.com/security/updates/classification/#critical
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/
• https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/

Red Hat Enterprise Linux for x86_64 8

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
x86_64
firefox-60.7.2-3.el8_0.x86_64.rpm	SHA-256: be8b9dde872b7642563693ee82d40a9a5001482d83bde734fd5c8bb3b166575e
firefox-debuginfo-60.7.2-3.el8_0.x86_64.rpm	SHA-256: e54970c568e3f1ad20e3bf15536dbd895349d80869271e6ea5e85cacbd9d97e1
firefox-debugsource-60.7.2-3.el8_0.x86_64.rpm	SHA-256: 5a4c4cf758dc313b3cbd05110033734548b3f2a68f7424532de8d3e1af730a5c

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
s390x
firefox-60.7.2-3.el8_0.s390x.rpm	SHA-256: 1ec78496185393e3afe71e7937009688f733438541be7cab8d3d3388deebd831
firefox-debuginfo-60.7.2-3.el8_0.s390x.rpm	SHA-256: d28d5c744c6ed07a0f0fb19f9df032fa5a12d7f1e341bf684d2f5bc220d16cb4
firefox-debugsource-60.7.2-3.el8_0.s390x.rpm	SHA-256: 67c9f2d2869f8fce3bccfdaa33c4b00242f66550c778239cadea7644d6599ec9

Red Hat Enterprise Linux for Power, little endian 8

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
ppc64le
firefox-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: 743389feee668b0513e3bdf42a23a53873f3fd6f51c9de91907ffb8e3c202418
firefox-debuginfo-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: a62e1700fe454157663f37c96d3e990d32ea17405372d36d6c42706165b9749f
firefox-debugsource-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: 76765195dfea1e87c8b172785334743af338211c39932f329458dc405d1aaa60

Red Hat Enterprise Linux for ARM 64 8

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
aarch64
firefox-60.7.2-3.el8_0.aarch64.rpm	SHA-256: 0bce2697e7c53e9c21726f591d493a4b269b8af7d19538118e1dc6e5648f4555
firefox-debuginfo-60.7.2-3.el8_0.aarch64.rpm	SHA-256: dd7c68ef11d499af74f847da93703175c830d6e67ee528b4cadb73e433c1367f
firefox-debugsource-60.7.2-3.el8_0.aarch64.rpm	SHA-256: 68f317d9f6b5205a5776ae9bb6008037f2eeb2ce4944e2634008dac306d8d554

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.0

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
ppc64le
firefox-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: 743389feee668b0513e3bdf42a23a53873f3fd6f51c9de91907ffb8e3c202418
firefox-debuginfo-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: a62e1700fe454157663f37c96d3e990d32ea17405372d36d6c42706165b9749f
firefox-debugsource-60.7.2-3.el8_0.ppc64le.rpm	SHA-256: 76765195dfea1e87c8b172785334743af338211c39932f329458dc405d1aaa60

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.0

SRPM
firefox-60.7.2-3.el8_0.src.rpm	SHA-256: 59b7b251504e8ef230c44729e0399b9afc8d20632bf623bbfd77674953079b6b
x86_64
firefox-60.7.2-3.el8_0.x86_64.rpm	SHA-256: be8b9dde872b7642563693ee82d40a9a5001482d83bde734fd5c8bb3b166575e
firefox-debuginfo-60.7.2-3.el8_0.x86_64.rpm	SHA-256: e54970c568e3f1ad20e3bf15536dbd895349d80869271e6ea5e85cacbd9d97e1
firefox-debugsource-60.7.2-3.el8_0.x86_64.rpm	SHA-256: 5a4c4cf758dc313b3cbd05110033734548b3f2a68f7424532de8d3e1af730a5c