Stay Secure with the Latest Linux Advisories

security advisoryupdatesoftware update

Red Hat Enterprise Linux 8 RHSA-2020-5562-01 Important: Firefox Update

An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: firefox security update Advisory ID: RHSA-2020:5562-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:5562 Issue date: 2020-12-16 CVE Names: CVE-2020-16042 CVE-2020-26971 CVE-2020-26973 CVE-2020-26974 CVE-2020-26978 CVE-2020-35111 CVE-2020-35113 ==================================================================== 1. Summary: An update for firefox is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64 3. Description: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This update upgrades Firefox to version 78.6.0 ESR. Security Fix(es): * chromium-browser: Uninitialized Use in V8 (CVE-2020-16042) * Mozilla: Heap buffer overflow in WebGL (CVE-2020-26971) * Mozilla: CSS Sanitizer performed incorrect sanitization (CVE-2020-26973) * Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free (CVE-2020-26974) * Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 (CVE-2020-35113) * Mozilla: Internal network hosts could have been probed by amalicious webpage (CVE-2020-26978) * Mozilla: The proxy.onRequest API did not catch view-source URLs (CVE-2020-35111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1904515 - CVE-2020-16042 chromium-browser: Uninitialized Use in V8 1908022 - CVE-2020-26971 Mozilla: Heap buffer overflow in WebGL 1908023 - CVE-2020-26973 Mozilla: CSS Sanitizer performed incorrect sanitization 1908024 - CVE-2020-26974 Mozilla: Incorrect cast of StyleGenericFlexBasis resulted in a heap use-after-free 1908025 - CVE-2020-26978 Mozilla: Internal network hosts could have been probed by a malicious webpage 1908027 - CVE-2020-35111 Mozilla: The proxy.onRequest API did not catch view-source URLs 1908029 - CVE-2020-35113 Mozilla: Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: firefox-78.6.0-1.el8_3.src.rpm aarch64: firefox-78.6.0-1.el8_3.aarch64.rpm firefox-debuginfo-78.6.0-1.el8_3.aarch64.rpm firefox-debugsource-78.6.0-1.el8_3.aarch64.rpm ppc64le: firefox-78.6.0-1.el8_3.ppc64le.rpm firefox-debuginfo-78.6.0-1.el8_3.ppc64le.rpm firefox-debugsource-78.6.0-1.el8_3.ppc64le.rpm s390x: firefox-78.6.0-1.el8_3.s390x.rpm firefox-debuginfo-78.6.0-1.el8_3.s390x.rpm firefox-debugsource-78.6.0-1.el8_3.s390x.rpm x86_64: firefox-78.6.0-1.el8_3.x86_64.rpm firefox-debuginfo-78.6.0-1.el8_3.x86_64.rpm firefox-debugsource-78.6.0-1.el8_3.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7.References: https://access.redhat.com/security/cve/CVE-2020-16042 https://access.redhat.com/security/cve/CVE-2020-26971 https://access.redhat.com/security/cve/CVE-2020-26973 https://access.redhat.com/security/cve/CVE-2020-26974 https://access.redhat.com/security/cve/CVE-2020-26978 https://access.redhat.com/security/cve/CVE-2020-35111 https://access.redhat.com/security/cve/CVE-2020-35113 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX9m9otzjgjWX9erEAQh3jA//XkFooO51CRPA1jquHOpqfHLtk1mug3B5 bZKHbumzj+TjKC59zxtXJoyUxaLSN5/3jE2e9bm5zMBIrqls3uKbvqIUZGNo1TDj ZNbIyr/Pj8tQgYHNqrvdxqXXjW2pr3t/a1z1Bh1stdxW6xhY5csqA9aJF86gxKcP dWITDx3XWT94B9FzfE1eFItZ78clqeRIU0fFJSqmuu5cywNAwsGV3ofTn4/hiGAy yhVGkauXc/InJj89pez9QzRy0nQbxNLadrSSIVLWKJg+dh0OaEYB68gMIHt2NKlP JkCgXy93impknVzVjFc08pnDIo7ZmVpjOBwYdpN9Tc8ShzBs6YXJM9CZshN758xR VH8A79zIHJ876g142RBULd2LSVxOgdKJWR+P/JNzALfon/6lrtlmdyuEm0lvUb41 JguNgvh1JRTAS9tBl8ZIA5C+4k7Dtk0I0Km8VpYi5VCHOF9WYwLyEzTIIAFXyVV2 TIV5MmOlhInWfna5yxY2CQboAuxSbWh8xMZIF9TZ6VeIhw0BcMGhdXRgbWh/vjeM At2f9cahiAnQ9SCddiBHpKDBHCjH+JoAuKDqwZVxpQvDkJ3Tm4/c1WF1iqn98Udo Tfl02i9G4UPmwP8IS2NHAilU+H3U2dtR+z59M5PHXt5iXZPNy+XWdmV80ShOQNlt 9v6eqK9/3Wg=9wM9 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A significant Firefox revision for Red Hat Enterprise Linux tackles multiple urgent vulnerabilities to enhance online security.. Firefox Security Update, Red Hat Enterprise Linux, Web Safety, Security Fixes, Browser Update. . Severity: Important. LinuxSecurity.com Team

Dec 16, 2020 •Important Red Hat