Synopsis

Important: firefox security update

Type/Severity

Security Advisory: Important

Topic

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 68.5.0 ESR.

Security Fix(es):

• Mozilla: Missing bounds check on shared memory read in the parent process (CVE-2020-6796)
  
• Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5 (CVE-2020-6800)
  
• Mozilla: Incorrect parsing of template tag could result in JavaScript injection (CVE-2020-6798)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1 aarch64
• Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1 ppc64le
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1 x86_64

Fixes

• BZ - 1801916 - CVE-2020-6796 Mozilla: Missing bounds check on shared memory read in the parent process
• BZ - 1801918 - CVE-2020-6798 Mozilla: Incorrect parsing of template tag could result in JavaScript injection
• BZ - 1801920 - CVE-2020-6800 Mozilla: Memory safety bugs fixed in Firefox 73 and Firefox ESR 68.5

CVEs

• CVE-2020-6796
• CVE-2020-6798
• CVE-2020-6800

References

• https://access.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux for x86_64 8

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
x86_64
firefox-68.5.0-2.el8_1.x86_64.rpm	SHA-256: cee36f379aff52dd66dbef560fcc6d2707dea8abfaea1b5c02d3df1c0a99b2a3
firefox-debuginfo-68.5.0-2.el8_1.x86_64.rpm	SHA-256: c7fd0482cfcae1f21a317aea218825f77d8592fb71c1818e112850644420df72
firefox-debugsource-68.5.0-2.el8_1.x86_64.rpm	SHA-256: 97bdf3f05ff97248748f8a6be96fe03aca0e5bf83ff94ffe4b938fdd7cfa0b4f

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
x86_64
firefox-68.5.0-2.el8_1.x86_64.rpm	SHA-256: cee36f379aff52dd66dbef560fcc6d2707dea8abfaea1b5c02d3df1c0a99b2a3
firefox-debuginfo-68.5.0-2.el8_1.x86_64.rpm	SHA-256: c7fd0482cfcae1f21a317aea218825f77d8592fb71c1818e112850644420df72
firefox-debugsource-68.5.0-2.el8_1.x86_64.rpm	SHA-256: 97bdf3f05ff97248748f8a6be96fe03aca0e5bf83ff94ffe4b938fdd7cfa0b4f

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
s390x
firefox-68.5.0-2.el8_1.s390x.rpm	SHA-256: c346431edb4969ef479cebe9f93256abf24c084249d9619bd8a0e0f7f4b42288
firefox-debuginfo-68.5.0-2.el8_1.s390x.rpm	SHA-256: 35353932d72e4a58ff36877ceed5561b471ff6177af38c905eee7000ddd6e894
firefox-debugsource-68.5.0-2.el8_1.s390x.rpm	SHA-256: 60c6ae53137a79309fb13780087c18c4b517e687b20485a84cd930f4cfa89de5

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
s390x
firefox-68.5.0-2.el8_1.s390x.rpm	SHA-256: c346431edb4969ef479cebe9f93256abf24c084249d9619bd8a0e0f7f4b42288
firefox-debuginfo-68.5.0-2.el8_1.s390x.rpm	SHA-256: 35353932d72e4a58ff36877ceed5561b471ff6177af38c905eee7000ddd6e894
firefox-debugsource-68.5.0-2.el8_1.s390x.rpm	SHA-256: 60c6ae53137a79309fb13780087c18c4b517e687b20485a84cd930f4cfa89de5

Red Hat Enterprise Linux for Power, little endian 8

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
ppc64le
firefox-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: dde5873b16bf801e87a682f63f15e6be76444aa87beb12819a07cc6b22a6de69
firefox-debuginfo-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 6168e34feec843efe3522d7fecd2538c95ab2a8bfc00197e947477dffa058932
firefox-debugsource-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 2b49c143b5094d8fe087697b2204bbc8a6c9a2a407fb15d205c5b6b6f3493edf

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
ppc64le
firefox-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: dde5873b16bf801e87a682f63f15e6be76444aa87beb12819a07cc6b22a6de69
firefox-debuginfo-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 6168e34feec843efe3522d7fecd2538c95ab2a8bfc00197e947477dffa058932
firefox-debugsource-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 2b49c143b5094d8fe087697b2204bbc8a6c9a2a407fb15d205c5b6b6f3493edf

Red Hat Enterprise Linux for ARM 64 8

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
aarch64
firefox-68.5.0-2.el8_1.aarch64.rpm	SHA-256: 6d9b15474846562a2948138f77c7b3680f74b012da8ee262d4456c8a77731ed0
firefox-debuginfo-68.5.0-2.el8_1.aarch64.rpm	SHA-256: 49f594b2ff39dd022279012f73aa9bbdb33f2073f6787b5cbd19311f572ee7b1
firefox-debugsource-68.5.0-2.el8_1.aarch64.rpm	SHA-256: dc472d4b2b430273ff1d4a7ef2a0bc0357f0002362e61fec9c79e5630a2f35a7

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
aarch64
firefox-68.5.0-2.el8_1.aarch64.rpm	SHA-256: 6d9b15474846562a2948138f77c7b3680f74b012da8ee262d4456c8a77731ed0
firefox-debuginfo-68.5.0-2.el8_1.aarch64.rpm	SHA-256: 49f594b2ff39dd022279012f73aa9bbdb33f2073f6787b5cbd19311f572ee7b1
firefox-debugsource-68.5.0-2.el8_1.aarch64.rpm	SHA-256: dc472d4b2b430273ff1d4a7ef2a0bc0357f0002362e61fec9c79e5630a2f35a7

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
ppc64le
firefox-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: dde5873b16bf801e87a682f63f15e6be76444aa87beb12819a07cc6b22a6de69
firefox-debuginfo-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 6168e34feec843efe3522d7fecd2538c95ab2a8bfc00197e947477dffa058932
firefox-debugsource-68.5.0-2.el8_1.ppc64le.rpm	SHA-256: 2b49c143b5094d8fe087697b2204bbc8a6c9a2a407fb15d205c5b6b6f3493edf

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.1

SRPM
firefox-68.5.0-2.el8_1.src.rpm	SHA-256: 41b607ccae8a5589238ffeaf1f5df5875a32b6e3f1cf0d25fe15f49ec46f9e9f
x86_64
firefox-68.5.0-2.el8_1.x86_64.rpm	SHA-256: cee36f379aff52dd66dbef560fcc6d2707dea8abfaea1b5c02d3df1c0a99b2a3
firefox-debuginfo-68.5.0-2.el8_1.x86_64.rpm	SHA-256: c7fd0482cfcae1f21a317aea218825f77d8592fb71c1818e112850644420df72
firefox-debugsource-68.5.0-2.el8_1.x86_64.rpm	SHA-256: 97bdf3f05ff97248748f8a6be96fe03aca0e5bf83ff94ffe4b938fdd7cfa0b4f