Synopsis

Critical: firefox security update

Type/Severity

Security Advisory: Critical

Topic

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.4.1 ESR.

Security Fix(es):

• Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement (CVE-2019-17026)
  
• Mozilla: Bypass of @namespace CSS sanitization during pasting (CVE-2019-17016)
  
• Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)
  
• Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4 (CVE-2019-17024)
  
• Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Fixes

• BZ - 1788723 - CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
• BZ - 1788724 - CVE-2019-17017 Mozilla: Type Confusion in XPCVariant.cpp
• BZ - 1788726 - CVE-2019-17022 Mozilla: CSS sanitization does not escape HTML tags
• BZ - 1788727 - CVE-2019-17024 Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
• BZ - 1789214 - CVE-2019-17026 Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement

CVEs

• CVE-2019-17016
• CVE-2019-17017
• CVE-2019-17022
• CVE-2019-17024
• CVE-2019-17026

References

• https://access.redhat.com/security/updates/classification/#critical
• https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/

Red Hat Enterprise Linux for x86_64 8

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
x86_64
firefox-68.4.1-1.el8_1.x86_64.rpm	SHA-256: c40b60263f58f81c67c8653ca8a6ed266891ef977c99d737612674f057f12dba
firefox-debuginfo-68.4.1-1.el8_1.x86_64.rpm	SHA-256: fa057cc7f6c7cbcbf867babdca63037da204960f55a6996af385dc61cd5e1650
firefox-debugsource-68.4.1-1.el8_1.x86_64.rpm	SHA-256: 983f58291ad19946e80a90cd8ff27a4cbb782a94f1c197dc2ee69cc0520275f2

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
x86_64
firefox-68.4.1-1.el8_1.x86_64.rpm	SHA-256: c40b60263f58f81c67c8653ca8a6ed266891ef977c99d737612674f057f12dba
firefox-debuginfo-68.4.1-1.el8_1.x86_64.rpm	SHA-256: fa057cc7f6c7cbcbf867babdca63037da204960f55a6996af385dc61cd5e1650
firefox-debugsource-68.4.1-1.el8_1.x86_64.rpm	SHA-256: 983f58291ad19946e80a90cd8ff27a4cbb782a94f1c197dc2ee69cc0520275f2

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
s390x
firefox-68.4.1-1.el8_1.s390x.rpm	SHA-256: 7c1d64c53d1a4dcaa606fa164cb0743a9e2539960d227adf7c814f49e35618c5
firefox-debuginfo-68.4.1-1.el8_1.s390x.rpm	SHA-256: 6602810a1005b4cc397e988832e8e75f17fa8438e4159bff364c621cc65cba55
firefox-debugsource-68.4.1-1.el8_1.s390x.rpm	SHA-256: fa86c3cc4ddb1af2886da155bb24769e1e55e5a9f8a5925e6084c2478a8e3a20

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
s390x
firefox-68.4.1-1.el8_1.s390x.rpm	SHA-256: 7c1d64c53d1a4dcaa606fa164cb0743a9e2539960d227adf7c814f49e35618c5
firefox-debuginfo-68.4.1-1.el8_1.s390x.rpm	SHA-256: 6602810a1005b4cc397e988832e8e75f17fa8438e4159bff364c621cc65cba55
firefox-debugsource-68.4.1-1.el8_1.s390x.rpm	SHA-256: fa86c3cc4ddb1af2886da155bb24769e1e55e5a9f8a5925e6084c2478a8e3a20

Red Hat Enterprise Linux for Power, little endian 8

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
ppc64le
firefox-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 99254e61e3ccbe0120a4176502d7d4cba897abb9840915db4f2cef1774acd2f3
firefox-debuginfo-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 7fe01fac7214ae1390ad5122dc2ad099320fb2cc6695644957a86530e9f59766
firefox-debugsource-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 51cc9005db5ddf50820fee11744753423ff3eeec08044afc70f57eda028437df

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
ppc64le
firefox-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 99254e61e3ccbe0120a4176502d7d4cba897abb9840915db4f2cef1774acd2f3
firefox-debuginfo-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 7fe01fac7214ae1390ad5122dc2ad099320fb2cc6695644957a86530e9f59766
firefox-debugsource-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 51cc9005db5ddf50820fee11744753423ff3eeec08044afc70f57eda028437df

Red Hat Enterprise Linux for ARM 64 8

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
aarch64
firefox-68.4.1-1.el8_1.aarch64.rpm	SHA-256: 746a2d1027e9a021fcdbdb6e36bdc3eff38de7d5900ee5ecb6d81a9384904d25
firefox-debuginfo-68.4.1-1.el8_1.aarch64.rpm	SHA-256: 8852015699521d068a2b7322e4c791815fa26ca897a2d2ede3d083f181882b89
firefox-debugsource-68.4.1-1.el8_1.aarch64.rpm	SHA-256: c60675115e1cf9c44ff18d36518b58d879e5a1f85b5418efd466236f11674834

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
aarch64
firefox-68.4.1-1.el8_1.aarch64.rpm	SHA-256: 746a2d1027e9a021fcdbdb6e36bdc3eff38de7d5900ee5ecb6d81a9384904d25
firefox-debuginfo-68.4.1-1.el8_1.aarch64.rpm	SHA-256: 8852015699521d068a2b7322e4c791815fa26ca897a2d2ede3d083f181882b89
firefox-debugsource-68.4.1-1.el8_1.aarch64.rpm	SHA-256: c60675115e1cf9c44ff18d36518b58d879e5a1f85b5418efd466236f11674834

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
ppc64le
firefox-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 99254e61e3ccbe0120a4176502d7d4cba897abb9840915db4f2cef1774acd2f3
firefox-debuginfo-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 7fe01fac7214ae1390ad5122dc2ad099320fb2cc6695644957a86530e9f59766
firefox-debugsource-68.4.1-1.el8_1.ppc64le.rpm	SHA-256: 51cc9005db5ddf50820fee11744753423ff3eeec08044afc70f57eda028437df

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1

SRPM
firefox-68.4.1-1.el8_1.src.rpm	SHA-256: cf660154510d8fb3494b2b8a2ef49f0848a5ee21b9d21171fddac499871f2385
x86_64
firefox-68.4.1-1.el8_1.x86_64.rpm	SHA-256: c40b60263f58f81c67c8653ca8a6ed266891ef977c99d737612674f057f12dba
firefox-debuginfo-68.4.1-1.el8_1.x86_64.rpm	SHA-256: fa057cc7f6c7cbcbf867babdca63037da204960f55a6996af385dc61cd5e1650
firefox-debugsource-68.4.1-1.el8_1.x86_64.rpm	SHA-256: 983f58291ad19946e80a90cd8ff27a4cbb782a94f1c197dc2ee69cc0520275f2