Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.0152
Critical: firefox security update
16 January 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Firefox 68.4.1 ESR
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux WS/Desktop 8
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Access Confidential Data -- Remote with User Interaction
Reduced Security -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2019-17026 CVE-2019-17024 CVE-2019-17022
CVE-2019-17017 CVE-2019-17016
Reference: ESB-2020.0128
ESB-2020.0121
ESB-2020.0118
ESB-2020.0116
ESB-2020.0078
ESB-2020.0055
ESB-2020.0054
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:0111
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Critical: firefox security update
Advisory ID: RHSA-2020:0111-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0111
Issue date: 2020-01-14
CVE Names: CVE-2019-17016 CVE-2019-17017 CVE-2019-17022
CVE-2019-17024 CVE-2019-17026
=====================================================================
1. Summary:
An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, ppc64le, s390x, x86_64
3. Description:
Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.
This update upgrades Firefox to version 68.4.1 ESR.
Security Fix(es):
* Mozilla: IonMonkey type confusion with StoreElementHole and
FallibleStoreElement (CVE-2019-17026)
* Mozilla: Bypass of @namespace CSS sanitization during pasting
(CVE-2019-17016)
* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)
* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
(CVE-2019-17024)
* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Firefox must be restarted for the changes to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
1788723 - CVE-2019-17016 Mozilla: Bypass of @namespace CSS sanitization during pasting
1788724 - CVE-2019-17017 Mozilla: Type Confusion in XPCVariant.cpp
1788726 - CVE-2019-17022 Mozilla: CSS sanitization does not escape HTML tags
1788727 - CVE-2019-17024 Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
1789214 - CVE-2019-17026 Mozilla: IonMonkey type confusion with StoreElementHole and FallibleStoreElement
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
firefox-68.4.1-1.el8_1.src.rpm
aarch64:
firefox-68.4.1-1.el8_1.aarch64.rpm
firefox-debuginfo-68.4.1-1.el8_1.aarch64.rpm
firefox-debugsource-68.4.1-1.el8_1.aarch64.rpm
ppc64le:
firefox-68.4.1-1.el8_1.ppc64le.rpm
firefox-debuginfo-68.4.1-1.el8_1.ppc64le.rpm
firefox-debugsource-68.4.1-1.el8_1.ppc64le.rpm
s390x:
firefox-68.4.1-1.el8_1.s390x.rpm
firefox-debuginfo-68.4.1-1.el8_1.s390x.rpm
firefox-debugsource-68.4.1-1.el8_1.s390x.rpm
x86_64:
firefox-68.4.1-1.el8_1.x86_64.rpm
firefox-debuginfo-68.4.1-1.el8_1.x86_64.rpm
firefox-debugsource-68.4.1-1.el8_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-17016
https://access.redhat.com/security/cve/CVE-2019-17017
https://access.redhat.com/security/cve/CVE-2019-17022
https://access.redhat.com/security/cve/CVE-2019-17024
https://access.redhat.com/security/cve/CVE-2019-17026
https://access.redhat.com/security/updates/classification/#critical
https://www.mozilla.org/en-US/security/advisories/mfsa2020-02/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXh4LBtzjgjWX9erEAQivIRAAhKT7rC+XoJRZyThhW5ZAfzeE5m1tx06y
Na1LkgGrHQTa2Bu4Hj0TokQCL12Wmb1D0LEHLNsK9mcLOCzROi/p67aQIUy7MoJ+
KDmSc5j5dF9XhSFIjUFuWlQG6sEyyQZ+ZDw4b8kHy46KZoHGM5R7/9IlMFfSyJVB
jTClcunYlfGR6czIp5JTS0Wp/zwaBlj8V6NIWsSc7bxnBRy5TXtIrP4fg2dj3lJR
lUMNEnO9yKjc9HcMA0bpwXwg389JbhhzK0VIuyaU4NhAJkBlKo6ZW3s/dmaSeS8F
Ltyz7zuTXZVj948z2kh2ZAjXHvSGMXC9j2jd/+kOgCutySmfWlnv9sjFl6+zH89N
lfcSKcxSACXgEN2nQyXFaqKEXSdQ3FFp6no/LyHtjdpk7dHGTEHxn4YYK71rfKXz
jSH+ktDbFiqNNEzGdrkwgsRRH4tus2eXx45f2eLlJ9f6MDkqBKOJ1Ywtf5k3EuWd
oCDrhKWQR0Wxpt3VUs6ibwawU5HblP0CsFuxlKExgoxgIAekZAXXTsj6zwPNUUBv
s+b13I61kgkWcPojtmvYvVC2toXMPx7fNqxFQssRqj+h9gVxh/KVOpnoA8AxLSSg
+/P1hThn6DeB+h3cUpa0DnFsISoS3hQzJI8K2w6aQR0HhrcdLTT1JBnf5dFYOyJ3
ddX1CkQ28/A=
=VS+4
- -----END PGP SIGNATURE-----
- --
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXh+lkGaOgq3Tt24GAQgupxAAk6NqldUzNZyWOwtjWYBUcd7kqjTxZy31
8YJQ7t6emTh6J7Nol+Bj0RhMF9Z9+9+LCrqAe5Q7SfQz5fF1TvlFhvixDJ7bcc/j
fTjHoSFQzs+xSa5p87Cph8vhhF84QmApPipeCFOmhk75+P2F0XTZk65GMR4PuHEs
SLOhP6KoC6j2zCG+25DMc5jIEQLFrr6DRy+ZYNLge5S5zb4pDOn+bY6a/DAnSNOS
JLI7ruKT1jyJ3vLrvygxcC6wjIa/Wb5iYjbqg9It8M5M1NSXrsF6coXnrVGBId4/
sa0p2fjyDmbiJL8OvMBfDigT4AdyWL8alhZZknxCC9wywFliQFcMaY7723MCGBWI
lTawlH0gyf4VGc0QEbk+tGtB+Uyeb+C4dHzitpGNOsAbGyWmPdtVNTvE8mINi50H
TZi/1PoyZSSEdc2PH2XP20vFUXMV6k31Py71UxybLoFvmV+d4O6ZkORDv6vHrBNB
TYqvuQGso58jpo9e7hlz3zVPQeSbE23BF0v0dvRsseOVPipVwwGfpoh5JU6Cm0UH
2OoFMSwBzWWrJgDkxoJqescgER35cRxX3dHhW4qSI3uakSNrJ0/dokw2o68d12e8
LrCnj4Ww5DugOJLSYN2Sb6t+oSZdYkAqoHlNEj+9rK11BaBLS0Y4ih3cMSqYfqQt
aq0bfP196n4=
=8cdW
-----END PGP SIGNATURE-----