An update for Firefox is now available for Red Hat Enterprise Linux 9.0
Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.
This update upgrades Firefox to version 115.10.0 ESR.
Security Fix(es):
* GetBoundName in the JIT returned the wrong object (CVE-2024-3852)
* Out-of-bounds-read after mis-optimized switch statement (CVE-2024-3854)
* Incorrect JITting of arguments led to use-after-free during garbage
collection (CVE-2024-3857)
* Permission prompt input delay could expire when not in focus (CVE-2024-2609)
* Integer-overflow led to out-of-bounds-read in the OpenType sanitizer
(CVE-2024-3859)
* Potential use-after-free due to AlignedBuffer self-move (CVE-2024-3861)
* Memory safety bug fixed in Firefox 125, Firefox ESR 115.10, and Thunderbird
115.10 (CVE-2024-3864)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2024-2609: Product UI does not Warn User of Unsafe Actions (CWE-356)
CVE-2024-3852: Access of Resource Using Incompatible Type ('Type
Confusion') (CWE-843)
CVE-2024-3854: Out-of-bounds Read (CWE-125)
CVE-2024-3857: Use After Free (CWE-416)
CVE-2024-3859: Out-of-bounds Read (CWE-125)
CVE-2024-3861: Use After Free (CWE-416)
CVE-2024-3864: Buffer Copy without Checking Size of Input ('Classic Buffer
Overflow') (CWE-120)
|
