CVE-2018-12396

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR 60.3 and Firefox 63...

CVE-2018-18498

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird 60.4, Firefox ESR 60.4, and Firefox 64...

CVE-2018-12389

Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox ESR 60.3...

CVE-2018-12396

A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events. This allows for potential privilege escalation by the WebExtension on sites where content scripts should not be run. This vulnerability affects Firefox ESR 60.3 and Firefox 63...

CVE-2018-18494

A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

CVE-2018-18493

CVE-2018-18493 describes a buffer overflow in the Skia library used for hardware-accelerated 2D canvas, caused by 32-bit offset calculations where 64-bit calculations were needed. Affected products include Thunderbird < 60.4, Firefox ESR < 60.4, and Firefox

CVE-2018-12389

CVE-2018-12389 relates to memory safety bugs in Mozilla Firefox ESR 60.x affecting Firefox ESR < 60.3 and Thunderbird

CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This...

CVE-2018-18493

A buffer overflow can occur in the Skia library during buffer offset calculations with hardware accelerated canvas 2D actions due to the use of 32-bit calculations instead of 64-bit. This results in a potentially exploitable crash. This vulnerability affects Thunderbird 60.4, Firefox ESR 60.4, an...

CVE-2018-12397

CVE-2018-12397 affects Mozilla Firefox/Firefox ESR. The vulnerability arises from a WebExtension’s ability to access local files without the user-visible warning, bypassing the intended “Access your data for all websites” prompt. This can allow extensions to run content scripts on local pages wit...

CVE-2018-12391

During HTTP Live Stream playback on Firefox for Android, audio data can be accessed across origins in violation of security policies. Because the problem is in the underlying Android service, this issue is addressed by treating all HLS streams as cross-origin and opaque to access. Note: this issu...

CVE-2018-12397

A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user. This allows extensions to run content scripts in local pages without permission warnings when a local file is opened. This...

CVE-2018-18498

A potential vulnerability leading to an integer overflow can occur during buffer size calculations for images when a raw value is used instead of the checked value. This leads to a possible out-of-bounds write. This vulnerability affects Thunderbird 60.4, Firefox ESR 60.4, and Firefox 64...

Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20190219)

This update upgrades Firefox to version 60.5.1 ESR. Security Fixes : - chromium-browser, mozilla: Use after free in Skia CVE-2018-18356 - mozilla: Integer overflow in Skia CVE-2019-5785 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if descriptio...

firefox security update

CentOS Errata and Security Advisory CESA-2019:0374 An update for firefox is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

firefox security update

CentOS Errata and Security Advisory CESA-2019:0373 An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

firefox security update

60.5.1-1.0.1 - fix LDLIBRARYPATH - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat one 60.5.1-1 - Update to 60.5.1 ESR 60.5.0-3 - Added fix for rhbz1672424 - Firefox crashes on NFS drives...

Debian DSA-4391-1 : firefox-esr - security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-4391. The text...

firefox security update

60.5.1-1.0.1 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 60.5.1-1 - Update to 60.5.1 ESR 60.5.0-3 - Added fix for rhbz1672424 - Firefox crashes on NFS drives...