Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-5798 (GCVE-0-2019-5798)
Vulnerability from cvelistv5
Published
2019-05-23 19:17
Modified
2024-08-04 20:09
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Out of bounds read
Summary
Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T20:09:22.434Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://crbug.com/883596" }, { "name": "DSA-4451", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ", "x_transferred" ], "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "openSUSE-SU-2019:1666", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Chrome", "vendor": "Google", "versions": [ { "status": "affected", "version": "prior to 73.0.3683.75" } ] } ], "descriptions": [ { "lang": "en", "value": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page." } ], "problemTypes": [ { "descriptions": [ { "description": "Out of bounds read", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2019-06-28T17:06:06", "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://crbug.com/883596" }, { "name": "DSA-4451", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_BUGTRAQ" ], "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "openSUSE-SU-2019:1666", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "security@google.com", "ID": "CVE-2019-5798", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "Chrome", "version": { "version_data": [ { "version_value": "prior to 73.0.3683.75" } ] } } ] }, "vendor_name": "Google" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "Out of bounds read" } ] } ] }, "references": { "reference_data": [ { "name": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "refsource": "MISC", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" }, { "name": "https://crbug.com/883596", "refsource": "MISC", "url": "https://crbug.com/883596" }, { "name": "DSA-4451", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2019/dsa-4451" }, { "name": "20190527 [SECURITY] [DSA 4451-1] thunderbird security update", "refsource": "BUGTRAQ", "url": "https://seclists.org/bugtraq/2019/May/67" }, { "name": "[debian-lts-announce] 20190527 [SECURITY] [DLA 1806-1] thunderbird security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html" }, { "name": "USN-3997-1", "refsource": "UBUNTU", "url": "https://usn.ubuntu.com/3997-1/" }, { "name": "openSUSE-SU-2019:1484", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html" }, { "name": "RHSA-2019:1310", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "name": "RHSA-2019:1308", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "name": "RHSA-2019:1309", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "name": "openSUSE-SU-2019:1534", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html" }, { "name": "openSUSE-SU-2019:1664", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html" }, { "name": "openSUSE-SU-2019:1666", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "assignerShortName": "Chrome", "cveId": "CVE-2019-5798", "datePublished": "2019-05-23T19:17:29", "dateReserved": "2019-01-09T00:00:00", "dateUpdated": "2024-08-04T20:09:22.434Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-5798\",\"sourceIdentifier\":\"chrome-cve-admin@google.com\",\"published\":\"2019-05-23T20:29:01.047\",\"lastModified\":\"2024-11-21T04:45:30.940\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.\"},{\"lang\":\"es\",\"value\":\"La falta de comprobaci\u00f3n de l\u00edmites correcta en Skia en Google Chrome antes de la versi\u00f3n 73.0.3683.75, permiti\u00f3 que un atacante remoto ejecutara una lectura de memoria fuera de l\u00edmites por medio de una p\u00e1gina HTML creada.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"73.0.3683.75\",\"matchCriteriaId\":\"EA174888-9FEB-4029-8E0D-D6CFCF1A74F6\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"284A8DA0-317B-4BBE-AECB-7E91BBF0DD3B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*\",\"matchCriteriaId\":\"7A5301BF-1402-4BE0-A0F8-69FBE79BC6D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*\",\"matchCriteriaId\":\"23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07C312A0-CD2C-4B9C-B064-6409B25C278F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD783B0C-9246-47D9-A937-6144FE8BFF0F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:backports:sle-15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1CBC4824-9D9F-427D-87A6-60B2CEBAAFEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1E78106-58E6-4D59-990F-75DA575BFAD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"142AD0DD-4CF3-4D74-9442-459CE3347E3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F4CFF558-3C47-480D-A2F0-BABF26042943\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1308\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1309\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1310\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://crbug.com/883596\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://seclists.org/bugtraq/2019/May/67\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://usn.ubuntu.com/3997-1/\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4451\",\"source\":\"chrome-cve-admin@google.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00029.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00084.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1308\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1309\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2019:1310\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://crbug.com/883596\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/05/msg00038.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://seclists.org/bugtraq/2019/May/67\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://usn.ubuntu.com/3997-1/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.debian.org/security/2019/dsa-4451\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}" } }
RHSA-2019:1310
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1310", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1310.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:31+00:00", "generator": { "date": "2025-02-08T00:52:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1310", "initial_release_date": "2019-06-03T20:55:59+00:00", "revision_history": [ { "date": "2019-06-03T20:55:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.src", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.src", "product_id": "thunderbird-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1265
Vulnerability from csaf_redhat
Published
2019-05-23 15:42
Modified
2024-11-22 13:19
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1265", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1265.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:35+00:00", "generator": { "date": "2024-11-22T13:19:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1265", "initial_release_date": "2019-05-23T15:42:35+00:00", "revision_history": [ { "date": "2019-05-23T15:42:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:42:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.src", "product": { "name": "firefox-0:60.7.0-1.el7_6.src", "product_id": "firefox-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-0:60.7.0-1.el7_6.i686", "product_id": "firefox-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1309
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1309", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1309.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:24+00:00", "generator": { "date": "2025-02-08T00:52:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1309", "initial_release_date": "2019-06-03T20:55:50+00:00", "revision_history": [ { "date": "2019-06-03T20:55:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.src", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.src", "product_id": "thunderbird-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
RHSA-2019:1309
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1309", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1309.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:24+00:00", "generator": { "date": "2025-02-08T00:52:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1309", "initial_release_date": "2019-06-03T20:55:50+00:00", "revision_history": [ { "date": "2019-06-03T20:55:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.src", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.src", "product_id": "thunderbird-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:0708
Vulnerability from csaf_redhat
Published
2019-04-08 07:48
Modified
2025-03-19 14:55
Summary
Red Hat Security Advisory: chromium-browser security update
Notes
Topic
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 73.0.3683.75.
Security Fix(es):
* chromium-browser: Use after free in Canvas (CVE-2019-5787)
* chromium-browser: Use after free in FileAPI (CVE-2019-5788)
* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)
* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)
* chromium-browser: Type confusion in V8 (CVE-2019-5791)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)
* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)
* chromium-browser: Security UI spoofing (CVE-2019-5794)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)
* chromium-browser: Race condition in Extensions (CVE-2019-5796)
* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)
* chromium-browser: Security UI spoofing (CVE-2019-5802)
* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 73.0.3683.75.\n\nSecurity Fix(es):\n\n* chromium-browser: Use after free in Canvas (CVE-2019-5787)\n\n* chromium-browser: Use after free in FileAPI (CVE-2019-5788)\n\n* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)\n\n* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)\n\n* chromium-browser: Type confusion in V8 (CVE-2019-5791)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)\n\n* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5794)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)\n\n* chromium-browser: Race condition in Extensions (CVE-2019-5796)\n\n* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5802)\n\n* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:0708", "url": "https://access.redhat.com/errata/RHSA-2019:0708" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0708.json" } ], "title": "Red Hat Security Advisory: chromium-browser security update", "tracking": { "current_release_date": "2025-03-19T14:55:41+00:00", "generator": { "date": "2025-03-19T14:55:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:0708", "initial_release_date": "2019-04-08T07:48:59+00:00", "revision_history": [ { "date": "2019-04-08T07:48:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-04-08T07:48:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-19T14:55:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-5787", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688189" } ], "notes": [ { "category": "description", "text": "Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in Canvas", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5787" }, { "category": "external", "summary": "RHBZ#1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5787", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5787" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in Canvas" }, { "cve": "CVE-2019-5788", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688190" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in FileAPI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5788" }, { "category": "external", "summary": "RHBZ#1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5788", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in FileAPI" }, { "cve": "CVE-2019-5789", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688191" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebMIDI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5789" }, { "category": "external", "summary": "RHBZ#1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5789", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5789" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebMIDI" }, { "cve": "CVE-2019-5790", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688192" } ], "notes": [ { "category": "description", "text": "An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Heap buffer overflow in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5790" }, { "category": "external", "summary": "RHBZ#1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5790", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5790" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Heap buffer overflow in V8" }, { "cve": "CVE-2019-5791", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688193" } ], "notes": [ { "category": "description", "text": "Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Type confusion in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5791" }, { "category": "external", "summary": "RHBZ#1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5791", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5791" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Type confusion in V8" }, { "cve": "CVE-2019-5792", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688194" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5792" }, { "category": "external", "summary": "RHBZ#1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5792", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5792" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5793", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688195" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Excessive permissions for private API in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5793" }, { "category": "external", "summary": "RHBZ#1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5793", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5793" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Excessive permissions for private API in Extensions" }, { "cve": "CVE-2019-5794", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688196" } ], "notes": [ { "category": "description", "text": "Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5794" }, { "category": "external", "summary": "RHBZ#1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5794", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5795", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688197" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5795" }, { "category": "external", "summary": "RHBZ#1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5795", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5795" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5796", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688198" } ], "notes": [ { "category": "description", "text": "Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5796" }, { "category": "external", "summary": "RHBZ#1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5796", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5796" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in Extensions" }, { "cve": "CVE-2019-5797", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688199" } ], "notes": [ { "category": "description", "text": "Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in DOMStorage", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5797" }, { "category": "external", "summary": "RHBZ#1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in DOMStorage" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-5799", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688201" } ], "notes": [ { "category": "description", "text": "Incorrect inheritance of a new document\u0027s policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5799" }, { "category": "external", "summary": "RHBZ#1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5799", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5799" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5800", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688202" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5800" }, { "category": "external", "summary": "RHBZ#1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5802", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688204" } ], "notes": [ { "category": "description", "text": "Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5802" }, { "category": "external", "summary": "RHBZ#1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5802", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5802" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5803", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688205" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with Javascript URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5803" }, { "category": "external", "summary": "RHBZ#1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5803", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5803" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "chromium-browser: CSP bypass with Javascript URLs" } ] }
rhsa-2019_0708
Vulnerability from csaf_redhat
Published
2019-04-08 07:48
Modified
2024-11-15 08:23
Summary
Red Hat Security Advisory: chromium-browser security update
Notes
Topic
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 73.0.3683.75.
Security Fix(es):
* chromium-browser: Use after free in Canvas (CVE-2019-5787)
* chromium-browser: Use after free in FileAPI (CVE-2019-5788)
* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)
* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)
* chromium-browser: Type confusion in V8 (CVE-2019-5791)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)
* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)
* chromium-browser: Security UI spoofing (CVE-2019-5794)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)
* chromium-browser: Race condition in Extensions (CVE-2019-5796)
* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)
* chromium-browser: Security UI spoofing (CVE-2019-5802)
* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 73.0.3683.75.\n\nSecurity Fix(es):\n\n* chromium-browser: Use after free in Canvas (CVE-2019-5787)\n\n* chromium-browser: Use after free in FileAPI (CVE-2019-5788)\n\n* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)\n\n* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)\n\n* chromium-browser: Type confusion in V8 (CVE-2019-5791)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)\n\n* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5794)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)\n\n* chromium-browser: Race condition in Extensions (CVE-2019-5796)\n\n* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5802)\n\n* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:0708", "url": "https://access.redhat.com/errata/RHSA-2019:0708" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0708.json" } ], "title": "Red Hat Security Advisory: chromium-browser security update", "tracking": { "current_release_date": "2024-11-15T08:23:01+00:00", "generator": { "date": "2024-11-15T08:23:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:0708", "initial_release_date": "2019-04-08T07:48:59+00:00", "revision_history": [ { "date": "2019-04-08T07:48:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-04-08T07:48:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T08:23:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-5787", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688189" } ], "notes": [ { "category": "description", "text": "Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in Canvas", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5787" }, { "category": "external", "summary": "RHBZ#1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5787", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5787" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in Canvas" }, { "cve": "CVE-2019-5788", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688190" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in FileAPI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5788" }, { "category": "external", "summary": "RHBZ#1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5788", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in FileAPI" }, { "cve": "CVE-2019-5789", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688191" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebMIDI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5789" }, { "category": "external", "summary": "RHBZ#1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5789", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5789" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebMIDI" }, { "cve": "CVE-2019-5790", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688192" } ], "notes": [ { "category": "description", "text": "An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Heap buffer overflow in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5790" }, { "category": "external", "summary": "RHBZ#1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5790", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5790" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Heap buffer overflow in V8" }, { "cve": "CVE-2019-5791", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688193" } ], "notes": [ { "category": "description", "text": "Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Type confusion in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5791" }, { "category": "external", "summary": "RHBZ#1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5791", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5791" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Type confusion in V8" }, { "cve": "CVE-2019-5792", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688194" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5792" }, { "category": "external", "summary": "RHBZ#1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5792", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5792" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5793", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688195" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Excessive permissions for private API in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5793" }, { "category": "external", "summary": "RHBZ#1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5793", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5793" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Excessive permissions for private API in Extensions" }, { "cve": "CVE-2019-5794", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688196" } ], "notes": [ { "category": "description", "text": "Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5794" }, { "category": "external", "summary": "RHBZ#1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5794", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5795", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688197" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5795" }, { "category": "external", "summary": "RHBZ#1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5795", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5795" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5796", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688198" } ], "notes": [ { "category": "description", "text": "Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5796" }, { "category": "external", "summary": "RHBZ#1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5796", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5796" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in Extensions" }, { "cve": "CVE-2019-5797", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688199" } ], "notes": [ { "category": "description", "text": "Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in DOMStorage", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5797" }, { "category": "external", "summary": "RHBZ#1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in DOMStorage" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-5799", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688201" } ], "notes": [ { "category": "description", "text": "Incorrect inheritance of a new document\u0027s policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5799" }, { "category": "external", "summary": "RHBZ#1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5799", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5799" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5800", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688202" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5800" }, { "category": "external", "summary": "RHBZ#1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5802", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688204" } ], "notes": [ { "category": "description", "text": "Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5802" }, { "category": "external", "summary": "RHBZ#1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5802", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5802" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5803", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688205" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with Javascript URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5803" }, { "category": "external", "summary": "RHBZ#1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5803", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5803" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "chromium-browser: CSP bypass with Javascript URLs" } ] }
RHSA-2019:1269
Vulnerability from csaf_redhat
Published
2019-05-23 16:08
Modified
2025-02-08 00:51
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1269", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1269.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:51:53+00:00", "generator": { "date": "2025-02-08T00:51:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1269", "initial_release_date": "2019-05-23T16:08:37+00:00", "revision_history": [ { "date": "2019-05-23T16:08:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T16:08:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:51:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.src", "product": { "name": "firefox-0:60.7.0-1.el8_0.src", "product_id": "firefox-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src" }, "product_reference": "firefox-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1269
Vulnerability from csaf_redhat
Published
2019-05-23 16:08
Modified
2025-02-08 00:51
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1269", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1269.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:51:53+00:00", "generator": { "date": "2025-02-08T00:51:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1269", "initial_release_date": "2019-05-23T16:08:37+00:00", "revision_history": [ { "date": "2019-05-23T16:08:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T16:08:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:51:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.src", "product": { "name": "firefox-0:60.7.0-1.el8_0.src", "product_id": "firefox-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src" }, "product_reference": "firefox-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1267
Vulnerability from csaf_redhat
Published
2019-05-23 15:53
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1267", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1267.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:52:09+00:00", "generator": { "date": "2025-02-08T00:52:09+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1267", "initial_release_date": "2019-05-23T15:53:40+00:00", "revision_history": [ { "date": "2019-05-23T15:53:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:53:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:09+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-0:60.7.0-1.el6_10.i686", "product_id": "firefox-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.src", "product": { "name": "firefox-0:60.7.0-1.el6_10.src", "product_id": "firefox-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
RHSA-2019:1308
Vulnerability from csaf_redhat
Published
2019-06-03 20:52
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1308", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1308.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:17+00:00", "generator": { "date": "2025-02-08T00:52:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1308", "initial_release_date": "2019-06-03T20:52:39+00:00", "revision_history": [ { "date": "2019-06-03T20:52:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:52:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.src", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.src", "product_id": "thunderbird-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1309
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2024-11-22 13:19
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1309", "url": "https://access.redhat.com/errata/RHSA-2019:1309" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1309.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:19:55+00:00", "generator": { "date": "2024-11-22T13:19:55+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1309", "initial_release_date": "2019-06-03T20:55:50+00:00", "revision_history": [ { "date": "2019-06-03T20:55:50+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:50+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:55+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_id": "thunderbird-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.src", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.src", "product_id": "thunderbird-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_id": "thunderbird-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)", "product_id": "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:50+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1309" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Server-optional-Alt-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-Alt-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:thunderbird-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:thunderbird-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1310
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1310", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1310.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:31+00:00", "generator": { "date": "2025-02-08T00:52:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1310", "initial_release_date": "2019-06-03T20:55:59+00:00", "revision_history": [ { "date": "2019-06-03T20:55:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.src", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.src", "product_id": "thunderbird-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1269
Vulnerability from csaf_redhat
Published
2019-05-23 16:08
Modified
2024-11-22 13:19
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1269", "url": "https://access.redhat.com/errata/RHSA-2019:1269" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1269.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:29+00:00", "generator": { "date": "2024-11-22T13:19:29+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1269", "initial_release_date": "2019-05-23T16:08:37+00:00", "revision_history": [ { "date": "2019-05-23T16:08:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T16:08:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:29+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=s390x" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el8_0.src", "product": { "name": "firefox-0:60.7.0-1.el8_0.src", "product_id": "firefox-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src" }, "product_reference": "firefox-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.s390x", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "firefox-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T16:08:37+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1269" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:firefox-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.aarch64", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.s390x", "AppStream-8.0.0.Z:firefox-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1308
Vulnerability from csaf_redhat
Published
2019-06-03 20:52
Modified
2024-11-22 13:19
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1308", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1308.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:19:49+00:00", "generator": { "date": "2024-11-22T13:19:49+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1308", "initial_release_date": "2019-06-03T20:52:39+00:00", "revision_history": [ { "date": "2019-06-03T20:52:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:52:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:49+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.src", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.src", "product_id": "thunderbird-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
RHSA-2019:1267
Vulnerability from csaf_redhat
Published
2019-05-23 15:53
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1267", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1267.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:52:09+00:00", "generator": { "date": "2025-02-08T00:52:09+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1267", "initial_release_date": "2019-05-23T15:53:40+00:00", "revision_history": [ { "date": "2019-05-23T15:53:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:53:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:09+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-0:60.7.0-1.el6_10.i686", "product_id": "firefox-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.src", "product": { "name": "firefox-0:60.7.0-1.el6_10.src", "product_id": "firefox-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1308
Vulnerability from csaf_redhat
Published
2019-06-03 20:52
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1308", "url": "https://access.redhat.com/errata/RHSA-2019:1308" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1308.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2025-02-08T00:52:17+00:00", "generator": { "date": "2025-02-08T00:52:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1308", "initial_release_date": "2019-06-03T20:52:39+00:00", "revision_history": [ { "date": "2019-06-03T20:52:39+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:52:39+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=ppc64le" } } }, { "category": "product_version", "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_id": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debugsource@60.7.0-1.el8_0?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el8_0.src", "product": { "name": "thunderbird-0:60.7.0-1.el8_0.src", "product_id": "thunderbird-0:60.7.0-1.el8_0.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el8_0?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.src as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.src", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "relates_to_product_reference": "AppStream-8.0.0.Z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" }, "product_reference": "thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64", "relates_to_product_reference": "AppStream-8.0.0.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:52:39+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.src", "AppStream-8.0.0.Z:thunderbird-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debuginfo-0:60.7.0-1.el8_0.x86_64", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.ppc64le", "AppStream-8.0.0.Z:thunderbird-debugsource-0:60.7.0-1.el8_0.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
RHSA-2019:1265
Vulnerability from csaf_redhat
Published
2019-05-23 15:42
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1265", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1265.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:52:02+00:00", "generator": { "date": "2025-02-08T00:52:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1265", "initial_release_date": "2019-05-23T15:42:35+00:00", "revision_history": [ { "date": "2019-05-23T15:42:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:42:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.src", "product": { "name": "firefox-0:60.7.0-1.el7_6.src", "product_id": "firefox-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-0:60.7.0-1.el7_6.i686", "product_id": "firefox-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019_1267
Vulnerability from csaf_redhat
Published
2019-05-23 15:53
Modified
2024-11-22 13:19
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1267", "url": "https://access.redhat.com/errata/RHSA-2019:1267" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1267.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2024-11-22T13:19:41+00:00", "generator": { "date": "2024-11-22T13:19:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1267", "initial_release_date": "2019-05-23T15:53:40+00:00", "revision_history": [ { "date": "2019-05-23T15:53:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:53:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:19:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::computenode" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product": { "name": "firefox-0:60.7.0-1.el6_10.x86_64", "product_id": "firefox-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.i686", "product": { "name": "firefox-0:60.7.0-1.el6_10.i686", "product_id": "firefox-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.src", "product": { "name": "firefox-0:60.7.0-1.el6_10.src", "product_id": "firefox-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.s390x", "product": { "name": "firefox-0:60.7.0-1.el6_10.s390x", "product_id": "firefox-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product": { "name": "firefox-0:60.7.0-1.el6_10.ppc64", "product_id": "firefox-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Optional (v. 6)", "product_id": "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Optional (v. 6)", "product_id": "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server (v. 6)", "product_id": "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src" }, "product_reference": "firefox-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 6)", "product_id": "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-optional-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:53:40+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1267" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Client-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6ComputeNode-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6ComputeNode-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.src", "6Workstation-optional-6.10.z:firefox-0:60.7.0-1.el6_10.x86_64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-optional-6.10.z:firefox-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
rhsa-2019:1265
Vulnerability from csaf_redhat
Published
2019-05-23 15:42
Modified
2025-02-08 00:52
Summary
Red Hat Security Advisory: firefox security update
Notes
Topic
An update for firefox is now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 60.7.0 ESR.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for firefox is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nThis update upgrades Firefox to version 60.7.0 ESR.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Type confusion with object groups and UnboxedObjects (CVE-2019-9816)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1265", "url": "https://access.redhat.com/errata/RHSA-2019:1265" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#critical", "url": "https://access.redhat.com/security/updates/classification/#critical" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1265.json" } ], "title": "Red Hat Security Advisory: firefox security update", "tracking": { "current_release_date": "2025-02-08T00:52:02+00:00", "generator": { "date": "2025-02-08T00:52:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.3.0" } }, "id": "RHSA-2019:1265", "initial_release_date": "2019-05-23T15:42:35+00:00", "revision_history": [ { "date": "2019-05-23T15:42:35+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-05-23T15:42:35+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-02-08T00:52:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Client (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product": { "name": "Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product": { "name": "Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=x86_64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product": { "name": "firefox-0:60.7.0-1.el7_6.x86_64", "product_id": "firefox-0:60.7.0-1.el7_6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.src", "product": { "name": "firefox-0:60.7.0-1.el7_6.src", "product_id": "firefox-0:60.7.0-1.el7_6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=i686" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.i686", "product": { "name": "firefox-0:60.7.0-1.el7_6.i686", "product_id": "firefox-0:60.7.0-1.el7_6.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=s390x" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.s390x", "product": { "name": "firefox-0:60.7.0-1.el7_6.s390x", "product_id": "firefox-0:60.7.0-1.el7_6.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=ppc64le" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_id": "firefox-0:60.7.0-1.el7_6.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox-debuginfo@60.7.0-1.el7_6?arch=aarch64" } } }, { "category": "product_version", "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product": { "name": "firefox-0:60.7.0-1.el7_6.aarch64", "product_id": "firefox-0:60.7.0-1.el7_6.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/firefox@60.7.0-1.el7_6?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client (v. 7)", "product_id": "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Client Optional (v. 7)", "product_id": "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Client-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7)", "product_id": "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)", "product_id": "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-Alt-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7)", "product_id": "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Server-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 7)", "product_id": "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.src as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src" }, "product_reference": "firefox-0:60.7.0-1.el7_6.src", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.i686 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.i686", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "relates_to_product_reference": "7Workstation-optional-7.6.Z" }, { "category": "default_component_of", "full_product_name": { "name": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64 as a component of Red Hat Enterprise Linux Workstation Optional (v. 7)", "product_id": "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" }, "product_reference": "firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "relates_to_product_reference": "7Workstation-optional-7.6.Z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Samuel Gro\u00df" ], "organization": "Google Project Zero", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9816", "cwe": { "id": "CWE-843", "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712625" } ], "notes": [ { "category": "description", "text": "A possible vulnerability exists where type confusion can occur when manipulating JavaScript objects in object groups, allowing for the bypassing of security checks within these groups. *Note: this vulnerability has only been demonstrated with UnboxedObjects, which are disabled by default on all supported releases.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Type confusion with object groups and UnboxedObjects", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9816" }, { "category": "external", "summary": "RHBZ#1712625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712625" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9816", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9816" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9816" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9816" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Type confusion with object groups and UnboxedObjects" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-05-23T15:42:35+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Firefox must be restarted for the changes to take effect.", "product_ids": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1265" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Client-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Client-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-Alt-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-Alt-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Server-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Server-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.src", "7Workstation-optional-7.6.Z:firefox-0:60.7.0-1.el7_6.x86_64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.aarch64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.i686", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.ppc64le", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.s390x", "7Workstation-optional-7.6.Z:firefox-debuginfo-0:60.7.0-1.el7_6.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
RHSA-2019:0708
Vulnerability from csaf_redhat
Published
2019-04-08 07:48
Modified
2025-03-19 14:55
Summary
Red Hat Security Advisory: chromium-browser security update
Notes
Topic
An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Chromium is an open-source web browser, powered by WebKit (Blink).
This update upgrades Chromium to version 73.0.3683.75.
Security Fix(es):
* chromium-browser: Use after free in Canvas (CVE-2019-5787)
* chromium-browser: Use after free in FileAPI (CVE-2019-5788)
* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)
* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)
* chromium-browser: Type confusion in V8 (CVE-2019-5791)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)
* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)
* chromium-browser: Security UI spoofing (CVE-2019-5794)
* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)
* chromium-browser: Race condition in Extensions (CVE-2019-5796)
* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)
* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)
* chromium-browser: Security UI spoofing (CVE-2019-5802)
* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for chromium-browser is now available for Red Hat Enterprise Linux 6 Supplementary.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Chromium is an open-source web browser, powered by WebKit (Blink).\n\nThis update upgrades Chromium to version 73.0.3683.75.\n\nSecurity Fix(es):\n\n* chromium-browser: Use after free in Canvas (CVE-2019-5787)\n\n* chromium-browser: Use after free in FileAPI (CVE-2019-5788)\n\n* chromium-browser: Use after free in WebMIDI (CVE-2019-5789)\n\n* chromium-browser: Heap buffer overflow in V8 (CVE-2019-5790)\n\n* chromium-browser: Type confusion in V8 (CVE-2019-5791)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5792)\n\n* chromium-browser: Excessive permissions for private API in Extensions (CVE-2019-5793)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5794)\n\n* chromium-browser: Integer overflow in PDFium (CVE-2019-5795)\n\n* chromium-browser: Race condition in Extensions (CVE-2019-5796)\n\n* chromium-browser: Race condition in DOMStorage (CVE-2019-5797)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5799)\n\n* chromium-browser: CSP bypass with blob URL (CVE-2019-5800)\n\n* chromium-browser: Security UI spoofing (CVE-2019-5802)\n\n* chromium-browser: CSP bypass with Javascript URLs (CVE-2019-5803)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:0708", "url": "https://access.redhat.com/errata/RHSA-2019:0708" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0708.json" } ], "title": "Red Hat Security Advisory: chromium-browser security update", "tracking": { "current_release_date": "2025-03-19T14:55:41+00:00", "generator": { "date": "2025-03-19T14:55:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.4.1" } }, "id": "RHSA-2019:0708", "initial_release_date": "2019-04-08T07:48:59+00:00", "revision_history": [ { "date": "2019-04-08T07:48:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-04-08T07:48:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-03-19T14:55:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhel_extras:6" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux Supplementary" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser@73.0.3683.75-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_id": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/chromium-browser-debuginfo@73.0.3683.75-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop Supplementary (v. 6)", "product_id": "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Client-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux HPC Node Supplementary (v. 6)", "product_id": "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6ComputeNode-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Supplementary (v. 6)", "product_id": "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Server-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation Supplementary (v. 6)", "product_id": "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" }, "product_reference": "chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-Supplementary-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-5787", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688189" } ], "notes": [ { "category": "description", "text": "Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in Canvas", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5787" }, { "category": "external", "summary": "RHBZ#1688189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688189" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5787", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5787" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5787" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in Canvas" }, { "cve": "CVE-2019-5788", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688190" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in FileAPI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5788" }, { "category": "external", "summary": "RHBZ#1688190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688190" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5788", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5788" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5788" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in FileAPI" }, { "cve": "CVE-2019-5789", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688191" } ], "notes": [ { "category": "description", "text": "An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Use after free in WebMIDI", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5789" }, { "category": "external", "summary": "RHBZ#1688191", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688191" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5789", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5789" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5789" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Use after free in WebMIDI" }, { "cve": "CVE-2019-5790", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688192" } ], "notes": [ { "category": "description", "text": "An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Heap buffer overflow in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5790" }, { "category": "external", "summary": "RHBZ#1688192", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688192" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5790", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5790" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5790" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Heap buffer overflow in V8" }, { "cve": "CVE-2019-5791", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688193" } ], "notes": [ { "category": "description", "text": "Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Type confusion in V8", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5791" }, { "category": "external", "summary": "RHBZ#1688193", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688193" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5791", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5791" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5791" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Type confusion in V8" }, { "cve": "CVE-2019-5792", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688194" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5792" }, { "category": "external", "summary": "RHBZ#1688194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5792", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5792" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5792" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5793", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688195" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Excessive permissions for private API in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5793" }, { "category": "external", "summary": "RHBZ#1688195", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688195" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5793", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5793" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5793" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Excessive permissions for private API in Extensions" }, { "cve": "CVE-2019-5794", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688196" } ], "notes": [ { "category": "description", "text": "Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5794" }, { "category": "external", "summary": "RHBZ#1688196", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688196" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5794", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5794" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5794" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5795", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688197" } ], "notes": [ { "category": "description", "text": "Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Integer overflow in PDFium", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5795" }, { "category": "external", "summary": "RHBZ#1688197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688197" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5795", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5795" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5795" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Integer overflow in PDFium" }, { "cve": "CVE-2019-5796", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688198" } ], "notes": [ { "category": "description", "text": "Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in Extensions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5796" }, { "category": "external", "summary": "RHBZ#1688198", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688198" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5796", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5796" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5796" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in Extensions" }, { "cve": "CVE-2019-5797", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688199" } ], "notes": [ { "category": "description", "text": "Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Race condition in DOMStorage", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5797" }, { "category": "external", "summary": "RHBZ#1688199", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688199" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5797" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Race condition in DOMStorage" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-5799", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688201" } ], "notes": [ { "category": "description", "text": "Incorrect inheritance of a new document\u0027s policy in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5799" }, { "category": "external", "summary": "RHBZ#1688201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688201" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5799", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5799" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5799" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5800", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688202" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with blob URL", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5800" }, { "category": "external", "summary": "RHBZ#1688202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688202" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5800" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: CSP bypass with blob URL" }, { "cve": "CVE-2019-5802", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688204" } ], "notes": [ { "category": "description", "text": "Incorrect handling of download origins in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Security UI spoofing", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5802" }, { "category": "external", "summary": "RHBZ#1688204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688204" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5802", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5802" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5802" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Security UI spoofing" }, { "cve": "CVE-2019-5803", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688205" } ], "notes": [ { "category": "description", "text": "Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to bypass content security policy via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: CSP bypass with Javascript URLs", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5803" }, { "category": "external", "summary": "RHBZ#1688205", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688205" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5803", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5803" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5803" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-04-08T07:48:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAfter installing the update, Chromium must be restarted for the changes to take effect.", "product_ids": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:0708" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Client-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6ComputeNode-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Server-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-0:73.0.3683.75-1.el6_10.x86_64", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.i686", "6Workstation-Supplementary-6.10.z:chromium-browser-debuginfo-0:73.0.3683.75-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "chromium-browser: CSP bypass with Javascript URLs" } ] }
rhsa-2019_1310
Vulnerability from csaf_redhat
Published
2019-06-03 20:55
Modified
2024-11-22 13:20
Summary
Red Hat Security Advisory: thunderbird security update
Notes
Topic
An update for thunderbird is now available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Mozilla Thunderbird is a standalone mail and newsgroup client.
This update upgrades Thunderbird to version 60.7.0.
Security Fix(es):
* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)
* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)
* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)
* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)
* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)
* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)
* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)
* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)
* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)
* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)
* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)
* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for thunderbird is now available for Red Hat Enterprise Linux 6.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nThis update upgrades Thunderbird to version 60.7.0.\n\nSecurity Fix(es):\n\n* Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7 (CVE-2019-9800)\n\n* Mozilla: Cross-origin theft of images with createImageBitmap (CVE-2019-9797)\n\n* Mozilla: Stealing of cross-domain images using canvas (CVE-2019-9817)\n\n* Mozilla: Compartment mismatch with fetch API (CVE-2019-9819)\n\n* Mozilla: Use-after-free of ChromeEventHandler by DocShell (CVE-2019-9820)\n\n* Mozilla: Use-after-free in XMLHttpRequest (CVE-2019-11691)\n\n* Mozilla: Use-after-free removing listeners in the event listener manager (CVE-2019-11692)\n\n* Mozilla: Buffer overflow in WebGL bufferdata on Linux (CVE-2019-11693)\n\n* mozilla: Cross-origin theft of images with ImageBitmapRenderingContext (CVE-2018-18511)\n\n* chromium-browser: Out of bounds read in Skia (CVE-2019-5798)\n\n* Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks (CVE-2019-11698)\n\n* libpng: use-after-free in png_image_free in png.c (CVE-2019-7317)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2019:1310", "url": "https://access.redhat.com/errata/RHSA-2019:1310" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-15/" }, { "category": "external", "summary": "1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1310.json" } ], "title": "Red Hat Security Advisory: thunderbird security update", "tracking": { "current_release_date": "2024-11-22T13:20:02+00:00", "generator": { "date": "2024-11-22T13:20:02+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2019:1310", "initial_release_date": "2019-06-03T20:55:59+00:00", "revision_history": [ { "date": "2019-06-03T20:55:59+00:00", "number": "1", "summary": "Initial version" }, { "date": "2019-06-03T20:55:59+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T13:20:02+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product": { "name": "Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::client" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product": { "name": "Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::server" } } }, { "category": "product_name", "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product": { "name": "Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:6::workstation" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=x86_64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_id": "thunderbird-0:60.7.0-1.el6_10.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=i686" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.i686", "product_id": "thunderbird-0:60.7.0-1.el6_10.i686", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=i686" } } } ], "category": "architecture", "name": "i686" }, { "branches": [ { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.src", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.src", "product_id": "thunderbird-0:60.7.0-1.el6_10.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=s390x" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_id": "thunderbird-0:60.7.0-1.el6_10.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird-debuginfo@60.7.0-1.el6_10?arch=ppc64" } } }, { "category": "product_version", "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_id": "thunderbird-0:60.7.0-1.el6_10.ppc64", "product_identification_helper": { "purl": "pkg:rpm/redhat/thunderbird@60.7.0-1.el6_10?arch=ppc64" } } } ], "category": "architecture", "name": "ppc64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Desktop (v. 6)", "product_id": "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Client-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 6)", "product_id": "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Server-optional-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.src as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.src", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "relates_to_product_reference": "6Workstation-6.10.z" }, { "category": "default_component_of", "full_product_name": { "name": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64 as a component of Red Hat Enterprise Linux Workstation (v. 6)", "product_id": "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" }, "product_reference": "thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "relates_to_product_reference": "6Workstation-6.10.z" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-18511", "discovery_date": "2019-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1676997" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read from a canvas element in violation of the same-origin policy using the transferFromImageBitmap method. *Note: This only affects Firefox 65. Previous versions are unaffected.*. This vulnerability affects Firefox \u003c 65.0.1.", "title": "Vulnerability description" }, { "category": "summary", "text": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-18511" }, { "category": "external", "summary": "RHBZ#1676997", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1676997" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-18511", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18511" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18511" } ], "release_date": "2019-02-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mozilla: Cross-origin theft of images with ImageBitmapRenderingContext" }, { "cve": "CVE-2019-5798", "discovery_date": "2019-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1688200" } ], "notes": [ { "category": "description", "text": "Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.", "title": "Vulnerability description" }, { "category": "summary", "text": "chromium-browser: Out of bounds read in Skia", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-5798" }, { "category": "external", "summary": "RHBZ#1688200", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688200" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5798", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5798" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5798" }, { "category": "external", "summary": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html", "url": "https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html" } ], "release_date": "2019-03-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "chromium-browser: Out of bounds read in Skia" }, { "cve": "CVE-2019-7317", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2019-02-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1672409" } ], "notes": [ { "category": "description", "text": "png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.", "title": "Vulnerability description" }, { "category": "summary", "text": "libpng: use-after-free in png_image_free in png.c", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-7317" }, { "category": "external", "summary": "RHBZ#1672409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1672409" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-7317", "url": "https://www.cve.org/CVERecord?id=CVE-2019-7317" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7317" } ], "release_date": "2019-01-25T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "libpng: use-after-free in png_image_free in png.c" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "AaylaSecura1138" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9797", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712622" } ], "notes": [ { "category": "description", "text": "Cross-origin images can be read in violation of the same-origin policy by exporting an image after using createImageBitmap to read the image and then rendering the resulting bitmap image within a canvas element. This vulnerability affects Firefox \u003c 66.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Cross-origin theft of images with createImageBitmap", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9797" }, { "category": "external", "summary": "RHBZ#1712622", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712622" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9797", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9797" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9797" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9797" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Cross-origin theft of images with createImageBitmap" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Olli Pettay", "Bogdan Tara", "Jan de Mooij", "Jason Kratzer", "Jan Varga", "Gary Kwong", "Tim Guan-tin Chien", "Tyson Smith", "Ronald Crane", "Ted Campbell" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9800", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712623" } ], "notes": [ { "category": "description", "text": "Mozilla developers and community members reported memory safety bugs present in Firefox 66, Firefox ESR 60.6, and Thunderbird 60.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9800" }, { "category": "external", "summary": "RHBZ#1712623", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712623" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9800", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9800" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9800" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9800" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Memory safety bugs fixed in Firefox 67 and Firefox ESR 60.7" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Lu\u1eadt Nguy\u1ec5n" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9817", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712626" } ], "notes": [ { "category": "description", "text": "Images from a different domain can be read using a canvas object in some circumstances. This could be used to steal image data from a different site in violation of same-origin policy. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Stealing of cross-domain images using canvas", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9817" }, { "category": "external", "summary": "RHBZ#1712626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712626" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9817", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9817" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9817" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9817" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Stealing of cross-domain images using canvas" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9819", "cwe": { "id": "CWE-567", "name": "Unsynchronized Access to Shared Data in a Multithreaded Context" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712628" } ], "notes": [ { "category": "description", "text": "A vulnerability where a JavaScript compartment mismatch can occur while working with the fetch API, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Compartment mismatch with fetch API", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9819" }, { "category": "external", "summary": "RHBZ#1712628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712628" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9819", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9819" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9819" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9819" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Compartment mismatch with fetch API" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-9820", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712629" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur in the chrome event handler when it is freed while still in use. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free of ChromeEventHandler by DocShell", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-9820" }, { "category": "external", "summary": "RHBZ#1712629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712629" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-9820", "url": "https://www.cve.org/CVERecord?id=CVE-2019-9820" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9820" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-9820" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free of ChromeEventHandler by DocShell" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11691", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712617" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when working with XMLHttpRequest (XHR) in an event loop, causing the XHR main thread to be called after it has been freed. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free in XMLHttpRequest", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11691" }, { "category": "external", "summary": "RHBZ#1712617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11691", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11691" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11691" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11691" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free in XMLHttpRequest" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Nils" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11692", "cwe": { "id": "CWE-416", "name": "Use After Free" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712618" } ], "notes": [ { "category": "description", "text": "A use-after-free vulnerability can occur when listeners are removed from the event listener manager while still in use, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Use-after-free removing listeners in the event listener manager", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11692" }, { "category": "external", "summary": "RHBZ#1712618", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712618" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11692", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11692" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11692" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11692" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Use-after-free removing listeners in the event listener manager" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "crixer" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11693", "cwe": { "id": "CWE-120", "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712619" } ], "notes": [ { "category": "description", "text": "The bufferdata function in WebGL is vulnerable to a buffer overflow with specific graphics drivers on Linux. This could result in malicious content freezing a tab or triggering a potentially exploitable crash. *Note: this issue only occurs on Linux. Other operating systems are unaffected.*. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Buffer overflow in WebGL bufferdata on Linux", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11693" }, { "category": "external", "summary": "RHBZ#1712619", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712619" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11693", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11693" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11693" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "Mozilla: Buffer overflow in WebGL bufferdata on Linux" }, { "acknowledgments": [ { "names": [ "the Mozilla project" ] }, { "names": [ "Abdulrahman Alqabandi" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2019-11698", "cwe": { "id": "CWE-829", "name": "Inclusion of Functionality from Untrusted Control Sphere" }, "discovery_date": "2019-05-22T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1712621" } ], "notes": [ { "category": "description", "text": "If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user\u0027s browser history can be run and transmitted to the content page via drop event data. This allows for the theft of browser history by a malicious site. This vulnerability affects Thunderbird \u003c 60.7, Firefox \u003c 67, and Firefox ESR \u003c 60.7.", "title": "Vulnerability description" }, { "category": "summary", "text": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks", "title": "Vulnerability summary" }, { "category": "other", "text": "In general, this flaw cannot be exploited through email in Thunderbird because scripting is disabled when reading mail, but it is potentially a risk in browser or browser-like contexts.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11698" }, { "category": "external", "summary": "RHBZ#1712621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712621" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11698", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11698" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11698" }, { "category": "external", "summary": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2019-14/#CVE-2019-11698" } ], "release_date": "2019-05-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2019-06-03T20:55:59+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running instances of Thunderbird must be restarted for the update to take effect.", "product_ids": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2019:1310" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Client-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Client-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Server-optional-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Server-optional-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.src", "6Workstation-6.10.z:thunderbird-0:60.7.0-1.el6_10.x86_64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.i686", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.ppc64", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.s390x", "6Workstation-6.10.z:thunderbird-debuginfo-0:60.7.0-1.el6_10.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Mozilla: Theft of user history data through drag and drop of hyperlinks to and from bookmarks" } ] }
opensuse-su-2024:12948-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
ungoogled-chromium-113.0.5672.92-1.1 on GA media
Notes
Title of the patch
ungoogled-chromium-113.0.5672.92-1.1 on GA media
Description of the patch
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-12948
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "ungoogled-chromium-113.0.5672.92-1.1 on GA media", "title": "Title of the patch" }, { "category": "description", "text": "These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.", "title": "Description of the patch" }, { "category": "details", "text": "openSUSE-Tumbleweed-2024-12948", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_12948-1.json" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3015 page", "url": "https://www.suse.com/security/cve/CVE-2011-3015/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3016 page", "url": "https://www.suse.com/security/cve/CVE-2011-3016/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3017 page", "url": "https://www.suse.com/security/cve/CVE-2011-3017/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3018 page", "url": "https://www.suse.com/security/cve/CVE-2011-3018/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3019 page", "url": "https://www.suse.com/security/cve/CVE-2011-3019/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3020 page", "url": "https://www.suse.com/security/cve/CVE-2011-3020/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3021 page", "url": "https://www.suse.com/security/cve/CVE-2011-3021/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3022 page", "url": "https://www.suse.com/security/cve/CVE-2011-3022/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3023 page", "url": "https://www.suse.com/security/cve/CVE-2011-3023/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3024 page", "url": "https://www.suse.com/security/cve/CVE-2011-3024/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3025 page", "url": "https://www.suse.com/security/cve/CVE-2011-3025/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3026 page", "url": "https://www.suse.com/security/cve/CVE-2011-3026/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3027 page", "url": "https://www.suse.com/security/cve/CVE-2011-3027/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3031 page", "url": "https://www.suse.com/security/cve/CVE-2011-3031/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3032 page", "url": "https://www.suse.com/security/cve/CVE-2011-3032/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3033 page", "url": "https://www.suse.com/security/cve/CVE-2011-3033/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3034 page", "url": "https://www.suse.com/security/cve/CVE-2011-3034/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3035 page", "url": "https://www.suse.com/security/cve/CVE-2011-3035/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3036 page", "url": "https://www.suse.com/security/cve/CVE-2011-3036/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3037 page", "url": "https://www.suse.com/security/cve/CVE-2011-3037/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3038 page", "url": "https://www.suse.com/security/cve/CVE-2011-3038/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3039 page", "url": "https://www.suse.com/security/cve/CVE-2011-3039/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3040 page", "url": "https://www.suse.com/security/cve/CVE-2011-3040/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3041 page", "url": "https://www.suse.com/security/cve/CVE-2011-3041/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3042 page", "url": "https://www.suse.com/security/cve/CVE-2011-3042/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3043 page", "url": "https://www.suse.com/security/cve/CVE-2011-3043/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3044 page", "url": "https://www.suse.com/security/cve/CVE-2011-3044/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3045 page", "url": "https://www.suse.com/security/cve/CVE-2011-3045/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3046 page", "url": "https://www.suse.com/security/cve/CVE-2011-3046/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3047 page", "url": "https://www.suse.com/security/cve/CVE-2011-3047/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3049 page", "url": "https://www.suse.com/security/cve/CVE-2011-3049/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3050 page", "url": "https://www.suse.com/security/cve/CVE-2011-3050/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3051 page", "url": "https://www.suse.com/security/cve/CVE-2011-3051/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3052 page", "url": "https://www.suse.com/security/cve/CVE-2011-3052/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3053 page", "url": "https://www.suse.com/security/cve/CVE-2011-3053/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3054 page", "url": "https://www.suse.com/security/cve/CVE-2011-3054/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3055 page", "url": "https://www.suse.com/security/cve/CVE-2011-3055/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3056 page", "url": "https://www.suse.com/security/cve/CVE-2011-3056/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3057 page", "url": "https://www.suse.com/security/cve/CVE-2011-3057/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3058 page", "url": "https://www.suse.com/security/cve/CVE-2011-3058/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3059 page", "url": "https://www.suse.com/security/cve/CVE-2011-3059/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3060 page", "url": "https://www.suse.com/security/cve/CVE-2011-3060/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3061 page", "url": "https://www.suse.com/security/cve/CVE-2011-3061/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3062 page", "url": "https://www.suse.com/security/cve/CVE-2011-3062/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3063 page", "url": "https://www.suse.com/security/cve/CVE-2011-3063/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3064 page", "url": "https://www.suse.com/security/cve/CVE-2011-3064/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3065 page", "url": "https://www.suse.com/security/cve/CVE-2011-3065/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3066 page", "url": "https://www.suse.com/security/cve/CVE-2011-3066/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3067 page", "url": "https://www.suse.com/security/cve/CVE-2011-3067/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3068 page", "url": "https://www.suse.com/security/cve/CVE-2011-3068/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3069 page", "url": "https://www.suse.com/security/cve/CVE-2011-3069/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3070 page", "url": "https://www.suse.com/security/cve/CVE-2011-3070/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3071 page", "url": "https://www.suse.com/security/cve/CVE-2011-3071/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3072 page", "url": "https://www.suse.com/security/cve/CVE-2011-3072/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3073 page", "url": "https://www.suse.com/security/cve/CVE-2011-3073/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3074 page", "url": "https://www.suse.com/security/cve/CVE-2011-3074/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3075 page", "url": "https://www.suse.com/security/cve/CVE-2011-3075/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3076 page", "url": "https://www.suse.com/security/cve/CVE-2011-3076/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3077 page", "url": "https://www.suse.com/security/cve/CVE-2011-3077/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3078 page", "url": "https://www.suse.com/security/cve/CVE-2011-3078/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3079 page", "url": "https://www.suse.com/security/cve/CVE-2011-3079/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3080 page", "url": "https://www.suse.com/security/cve/CVE-2011-3080/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3081 page", "url": "https://www.suse.com/security/cve/CVE-2011-3081/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3083 page", "url": "https://www.suse.com/security/cve/CVE-2011-3083/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3084 page", "url": "https://www.suse.com/security/cve/CVE-2011-3084/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3085 page", "url": "https://www.suse.com/security/cve/CVE-2011-3085/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3086 page", "url": "https://www.suse.com/security/cve/CVE-2011-3086/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3087 page", "url": "https://www.suse.com/security/cve/CVE-2011-3087/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3088 page", "url": "https://www.suse.com/security/cve/CVE-2011-3088/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3089 page", "url": "https://www.suse.com/security/cve/CVE-2011-3089/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3090 page", "url": "https://www.suse.com/security/cve/CVE-2011-3090/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3091 page", "url": "https://www.suse.com/security/cve/CVE-2011-3091/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3092 page", "url": "https://www.suse.com/security/cve/CVE-2011-3092/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3093 page", "url": "https://www.suse.com/security/cve/CVE-2011-3093/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3094 page", "url": "https://www.suse.com/security/cve/CVE-2011-3094/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3095 page", "url": "https://www.suse.com/security/cve/CVE-2011-3095/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3096 page", "url": "https://www.suse.com/security/cve/CVE-2011-3096/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3098 page", "url": "https://www.suse.com/security/cve/CVE-2011-3098/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3100 page", "url": "https://www.suse.com/security/cve/CVE-2011-3100/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3101 page", "url": "https://www.suse.com/security/cve/CVE-2011-3101/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3102 page", "url": "https://www.suse.com/security/cve/CVE-2011-3102/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3903 page", "url": "https://www.suse.com/security/cve/CVE-2011-3903/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3904 page", "url": "https://www.suse.com/security/cve/CVE-2011-3904/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3905 page", "url": "https://www.suse.com/security/cve/CVE-2011-3905/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3906 page", "url": "https://www.suse.com/security/cve/CVE-2011-3906/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3907 page", "url": "https://www.suse.com/security/cve/CVE-2011-3907/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3908 page", "url": "https://www.suse.com/security/cve/CVE-2011-3908/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3909 page", "url": "https://www.suse.com/security/cve/CVE-2011-3909/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3910 page", "url": "https://www.suse.com/security/cve/CVE-2011-3910/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3911 page", "url": "https://www.suse.com/security/cve/CVE-2011-3911/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3912 page", "url": "https://www.suse.com/security/cve/CVE-2011-3912/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3914 page", "url": "https://www.suse.com/security/cve/CVE-2011-3914/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3915 page", "url": "https://www.suse.com/security/cve/CVE-2011-3915/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3916 page", "url": "https://www.suse.com/security/cve/CVE-2011-3916/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3917 page", "url": "https://www.suse.com/security/cve/CVE-2011-3917/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3919 page", "url": "https://www.suse.com/security/cve/CVE-2011-3919/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3921 page", "url": "https://www.suse.com/security/cve/CVE-2011-3921/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3922 page", "url": "https://www.suse.com/security/cve/CVE-2011-3922/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3924 page", "url": "https://www.suse.com/security/cve/CVE-2011-3924/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3925 page", "url": "https://www.suse.com/security/cve/CVE-2011-3925/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3926 page", "url": "https://www.suse.com/security/cve/CVE-2011-3926/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3927 page", "url": "https://www.suse.com/security/cve/CVE-2011-3927/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3928 page", "url": "https://www.suse.com/security/cve/CVE-2011-3928/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3953 page", "url": "https://www.suse.com/security/cve/CVE-2011-3953/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3954 page", "url": "https://www.suse.com/security/cve/CVE-2011-3954/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3955 page", "url": "https://www.suse.com/security/cve/CVE-2011-3955/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3956 page", "url": "https://www.suse.com/security/cve/CVE-2011-3956/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3957 page", "url": "https://www.suse.com/security/cve/CVE-2011-3957/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3958 page", "url": "https://www.suse.com/security/cve/CVE-2011-3958/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3959 page", "url": "https://www.suse.com/security/cve/CVE-2011-3959/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3960 page", "url": "https://www.suse.com/security/cve/CVE-2011-3960/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3961 page", "url": "https://www.suse.com/security/cve/CVE-2011-3961/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3962 page", "url": "https://www.suse.com/security/cve/CVE-2011-3962/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3963 page", "url": "https://www.suse.com/security/cve/CVE-2011-3963/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3964 page", "url": "https://www.suse.com/security/cve/CVE-2011-3964/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3965 page", "url": "https://www.suse.com/security/cve/CVE-2011-3965/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3966 page", "url": "https://www.suse.com/security/cve/CVE-2011-3966/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3967 page", "url": "https://www.suse.com/security/cve/CVE-2011-3967/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3968 page", "url": "https://www.suse.com/security/cve/CVE-2011-3968/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3969 page", "url": "https://www.suse.com/security/cve/CVE-2011-3969/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3970 page", "url": "https://www.suse.com/security/cve/CVE-2011-3970/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3971 page", "url": "https://www.suse.com/security/cve/CVE-2011-3971/" }, { "category": "self", "summary": "SUSE CVE CVE-2011-3972 page", "url": "https://www.suse.com/security/cve/CVE-2011-3972/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-1521 page", "url": "https://www.suse.com/security/cve/CVE-2012-1521/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2807 page", "url": "https://www.suse.com/security/cve/CVE-2012-2807/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2815 page", "url": "https://www.suse.com/security/cve/CVE-2012-2815/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2816 page", "url": "https://www.suse.com/security/cve/CVE-2012-2816/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2817 page", "url": "https://www.suse.com/security/cve/CVE-2012-2817/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2818 page", "url": "https://www.suse.com/security/cve/CVE-2012-2818/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2819 page", "url": "https://www.suse.com/security/cve/CVE-2012-2819/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2820 page", "url": "https://www.suse.com/security/cve/CVE-2012-2820/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2821 page", "url": "https://www.suse.com/security/cve/CVE-2012-2821/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2823 page", "url": "https://www.suse.com/security/cve/CVE-2012-2823/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2825 page", "url": "https://www.suse.com/security/cve/CVE-2012-2825/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2826 page", "url": "https://www.suse.com/security/cve/CVE-2012-2826/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2829 page", "url": "https://www.suse.com/security/cve/CVE-2012-2829/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2830 page", "url": "https://www.suse.com/security/cve/CVE-2012-2830/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2831 page", "url": "https://www.suse.com/security/cve/CVE-2012-2831/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2834 page", "url": "https://www.suse.com/security/cve/CVE-2012-2834/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2842 page", "url": "https://www.suse.com/security/cve/CVE-2012-2842/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2843 page", "url": "https://www.suse.com/security/cve/CVE-2012-2843/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2865 page", "url": "https://www.suse.com/security/cve/CVE-2012-2865/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2866 page", "url": "https://www.suse.com/security/cve/CVE-2012-2866/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2867 page", "url": "https://www.suse.com/security/cve/CVE-2012-2867/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2868 page", "url": "https://www.suse.com/security/cve/CVE-2012-2868/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2869 page", "url": "https://www.suse.com/security/cve/CVE-2012-2869/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2870 page", "url": "https://www.suse.com/security/cve/CVE-2012-2870/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2871 page", "url": "https://www.suse.com/security/cve/CVE-2012-2871/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2872 page", "url": "https://www.suse.com/security/cve/CVE-2012-2872/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2874 page", "url": "https://www.suse.com/security/cve/CVE-2012-2874/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2876 page", "url": "https://www.suse.com/security/cve/CVE-2012-2876/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2877 page", "url": "https://www.suse.com/security/cve/CVE-2012-2877/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2878 page", "url": "https://www.suse.com/security/cve/CVE-2012-2878/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2879 page", "url": "https://www.suse.com/security/cve/CVE-2012-2879/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2880 page", "url": "https://www.suse.com/security/cve/CVE-2012-2880/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2881 page", "url": "https://www.suse.com/security/cve/CVE-2012-2881/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2882 page", "url": "https://www.suse.com/security/cve/CVE-2012-2882/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2883 page", "url": "https://www.suse.com/security/cve/CVE-2012-2883/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2884 page", "url": "https://www.suse.com/security/cve/CVE-2012-2884/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2885 page", "url": "https://www.suse.com/security/cve/CVE-2012-2885/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2886 page", "url": "https://www.suse.com/security/cve/CVE-2012-2886/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2887 page", "url": "https://www.suse.com/security/cve/CVE-2012-2887/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2888 page", "url": "https://www.suse.com/security/cve/CVE-2012-2888/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2889 page", "url": "https://www.suse.com/security/cve/CVE-2012-2889/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2891 page", "url": "https://www.suse.com/security/cve/CVE-2012-2891/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2892 page", "url": "https://www.suse.com/security/cve/CVE-2012-2892/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2893 page", "url": "https://www.suse.com/security/cve/CVE-2012-2893/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2894 page", "url": "https://www.suse.com/security/cve/CVE-2012-2894/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-2896 page", "url": "https://www.suse.com/security/cve/CVE-2012-2896/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5130 page", "url": "https://www.suse.com/security/cve/CVE-2012-5130/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5131 page", "url": "https://www.suse.com/security/cve/CVE-2012-5131/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5132 page", "url": "https://www.suse.com/security/cve/CVE-2012-5132/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5133 page", "url": "https://www.suse.com/security/cve/CVE-2012-5133/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5134 page", "url": "https://www.suse.com/security/cve/CVE-2012-5134/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5135 page", "url": "https://www.suse.com/security/cve/CVE-2012-5135/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5136 page", "url": "https://www.suse.com/security/cve/CVE-2012-5136/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5137 page", "url": "https://www.suse.com/security/cve/CVE-2012-5137/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5138 page", "url": "https://www.suse.com/security/cve/CVE-2012-5138/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5139 page", "url": "https://www.suse.com/security/cve/CVE-2012-5139/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5140 page", "url": "https://www.suse.com/security/cve/CVE-2012-5140/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5141 page", "url": "https://www.suse.com/security/cve/CVE-2012-5141/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5142 page", "url": "https://www.suse.com/security/cve/CVE-2012-5142/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5143 page", "url": "https://www.suse.com/security/cve/CVE-2012-5143/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5144 page", "url": "https://www.suse.com/security/cve/CVE-2012-5144/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5145 page", "url": "https://www.suse.com/security/cve/CVE-2012-5145/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5146 page", "url": "https://www.suse.com/security/cve/CVE-2012-5146/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5147 page", "url": "https://www.suse.com/security/cve/CVE-2012-5147/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5148 page", "url": "https://www.suse.com/security/cve/CVE-2012-5148/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5149 page", "url": "https://www.suse.com/security/cve/CVE-2012-5149/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5150 page", "url": "https://www.suse.com/security/cve/CVE-2012-5150/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5152 page", "url": "https://www.suse.com/security/cve/CVE-2012-5152/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5153 page", "url": "https://www.suse.com/security/cve/CVE-2012-5153/" }, { "category": "self", "summary": "SUSE CVE CVE-2012-5154 page", "url": "https://www.suse.com/security/cve/CVE-2012-5154/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0830 page", "url": "https://www.suse.com/security/cve/CVE-2013-0830/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0831 page", "url": "https://www.suse.com/security/cve/CVE-2013-0831/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0832 page", "url": "https://www.suse.com/security/cve/CVE-2013-0832/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0833 page", "url": "https://www.suse.com/security/cve/CVE-2013-0833/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0834 page", "url": "https://www.suse.com/security/cve/CVE-2013-0834/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0835 page", "url": "https://www.suse.com/security/cve/CVE-2013-0835/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0836 page", "url": "https://www.suse.com/security/cve/CVE-2013-0836/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0837 page", "url": "https://www.suse.com/security/cve/CVE-2013-0837/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0838 page", "url": "https://www.suse.com/security/cve/CVE-2013-0838/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0879 page", "url": "https://www.suse.com/security/cve/CVE-2013-0879/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0880 page", "url": "https://www.suse.com/security/cve/CVE-2013-0880/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0881 page", "url": "https://www.suse.com/security/cve/CVE-2013-0881/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0882 page", "url": "https://www.suse.com/security/cve/CVE-2013-0882/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0883 page", "url": "https://www.suse.com/security/cve/CVE-2013-0883/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0884 page", "url": "https://www.suse.com/security/cve/CVE-2013-0884/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0885 page", "url": "https://www.suse.com/security/cve/CVE-2013-0885/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0886 page", "url": "https://www.suse.com/security/cve/CVE-2013-0886/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0887 page", "url": "https://www.suse.com/security/cve/CVE-2013-0887/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0888 page", "url": "https://www.suse.com/security/cve/CVE-2013-0888/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0889 page", "url": "https://www.suse.com/security/cve/CVE-2013-0889/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0890 page", "url": "https://www.suse.com/security/cve/CVE-2013-0890/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0891 page", "url": "https://www.suse.com/security/cve/CVE-2013-0891/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0892 page", "url": "https://www.suse.com/security/cve/CVE-2013-0892/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0893 page", "url": "https://www.suse.com/security/cve/CVE-2013-0893/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0894 page", "url": "https://www.suse.com/security/cve/CVE-2013-0894/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0895 page", "url": "https://www.suse.com/security/cve/CVE-2013-0895/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0896 page", "url": "https://www.suse.com/security/cve/CVE-2013-0896/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0897 page", "url": "https://www.suse.com/security/cve/CVE-2013-0897/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0898 page", "url": "https://www.suse.com/security/cve/CVE-2013-0898/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0899 page", "url": "https://www.suse.com/security/cve/CVE-2013-0899/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-0900 page", "url": "https://www.suse.com/security/cve/CVE-2013-0900/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2838 page", "url": "https://www.suse.com/security/cve/CVE-2013-2838/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2906 page", "url": "https://www.suse.com/security/cve/CVE-2013-2906/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2907 page", "url": "https://www.suse.com/security/cve/CVE-2013-2907/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2908 page", "url": "https://www.suse.com/security/cve/CVE-2013-2908/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2909 page", "url": "https://www.suse.com/security/cve/CVE-2013-2909/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2910 page", "url": "https://www.suse.com/security/cve/CVE-2013-2910/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2911 page", "url": "https://www.suse.com/security/cve/CVE-2013-2911/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2912 page", "url": "https://www.suse.com/security/cve/CVE-2013-2912/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2913 page", "url": "https://www.suse.com/security/cve/CVE-2013-2913/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2914 page", "url": "https://www.suse.com/security/cve/CVE-2013-2914/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2915 page", "url": "https://www.suse.com/security/cve/CVE-2013-2915/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2916 page", "url": "https://www.suse.com/security/cve/CVE-2013-2916/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2917 page", "url": "https://www.suse.com/security/cve/CVE-2013-2917/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2918 page", "url": "https://www.suse.com/security/cve/CVE-2013-2918/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2919 page", "url": "https://www.suse.com/security/cve/CVE-2013-2919/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2920 page", "url": "https://www.suse.com/security/cve/CVE-2013-2920/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2921 page", "url": "https://www.suse.com/security/cve/CVE-2013-2921/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2922 page", "url": "https://www.suse.com/security/cve/CVE-2013-2922/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2923 page", "url": "https://www.suse.com/security/cve/CVE-2013-2923/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2924 page", "url": "https://www.suse.com/security/cve/CVE-2013-2924/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2925 page", "url": "https://www.suse.com/security/cve/CVE-2013-2925/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2926 page", "url": "https://www.suse.com/security/cve/CVE-2013-2926/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2927 page", "url": "https://www.suse.com/security/cve/CVE-2013-2927/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2928 page", "url": "https://www.suse.com/security/cve/CVE-2013-2928/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-2931 page", "url": "https://www.suse.com/security/cve/CVE-2013-2931/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6621 page", "url": "https://www.suse.com/security/cve/CVE-2013-6621/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6622 page", "url": "https://www.suse.com/security/cve/CVE-2013-6622/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6623 page", "url": "https://www.suse.com/security/cve/CVE-2013-6623/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6624 page", "url": "https://www.suse.com/security/cve/CVE-2013-6624/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6625 page", "url": "https://www.suse.com/security/cve/CVE-2013-6625/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6626 page", "url": "https://www.suse.com/security/cve/CVE-2013-6626/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6627 page", "url": "https://www.suse.com/security/cve/CVE-2013-6627/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6628 page", "url": "https://www.suse.com/security/cve/CVE-2013-6628/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6629 page", "url": "https://www.suse.com/security/cve/CVE-2013-6629/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6630 page", "url": "https://www.suse.com/security/cve/CVE-2013-6630/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6631 page", "url": "https://www.suse.com/security/cve/CVE-2013-6631/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6632 page", "url": "https://www.suse.com/security/cve/CVE-2013-6632/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6634 page", "url": "https://www.suse.com/security/cve/CVE-2013-6634/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6635 page", "url": "https://www.suse.com/security/cve/CVE-2013-6635/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6636 page", "url": "https://www.suse.com/security/cve/CVE-2013-6636/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6637 page", "url": "https://www.suse.com/security/cve/CVE-2013-6637/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6638 page", "url": "https://www.suse.com/security/cve/CVE-2013-6638/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6639 page", "url": "https://www.suse.com/security/cve/CVE-2013-6639/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6640 page", "url": "https://www.suse.com/security/cve/CVE-2013-6640/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6641 page", "url": "https://www.suse.com/security/cve/CVE-2013-6641/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6643 page", "url": "https://www.suse.com/security/cve/CVE-2013-6643/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6644 page", "url": "https://www.suse.com/security/cve/CVE-2013-6644/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6645 page", "url": "https://www.suse.com/security/cve/CVE-2013-6645/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6646 page", "url": "https://www.suse.com/security/cve/CVE-2013-6646/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6649 page", "url": "https://www.suse.com/security/cve/CVE-2013-6649/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6650 page", "url": "https://www.suse.com/security/cve/CVE-2013-6650/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6653 page", "url": "https://www.suse.com/security/cve/CVE-2013-6653/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6654 page", "url": "https://www.suse.com/security/cve/CVE-2013-6654/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6655 page", "url": "https://www.suse.com/security/cve/CVE-2013-6655/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6656 page", "url": "https://www.suse.com/security/cve/CVE-2013-6656/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6657 page", "url": "https://www.suse.com/security/cve/CVE-2013-6657/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6658 page", "url": "https://www.suse.com/security/cve/CVE-2013-6658/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6659 page", "url": "https://www.suse.com/security/cve/CVE-2013-6659/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6660 page", "url": "https://www.suse.com/security/cve/CVE-2013-6660/" }, { "category": "self", "summary": "SUSE CVE CVE-2013-6661 page", "url": "https://www.suse.com/security/cve/CVE-2013-6661/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-0574 page", "url": "https://www.suse.com/security/cve/CVE-2014-0574/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1700 page", "url": "https://www.suse.com/security/cve/CVE-2014-1700/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1701 page", "url": "https://www.suse.com/security/cve/CVE-2014-1701/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1702 page", "url": "https://www.suse.com/security/cve/CVE-2014-1702/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1703 page", "url": "https://www.suse.com/security/cve/CVE-2014-1703/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1704 page", "url": "https://www.suse.com/security/cve/CVE-2014-1704/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1705 page", "url": "https://www.suse.com/security/cve/CVE-2014-1705/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1713 page", "url": "https://www.suse.com/security/cve/CVE-2014-1713/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1714 page", "url": "https://www.suse.com/security/cve/CVE-2014-1714/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1715 page", "url": "https://www.suse.com/security/cve/CVE-2014-1715/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1716 page", "url": "https://www.suse.com/security/cve/CVE-2014-1716/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1717 page", "url": "https://www.suse.com/security/cve/CVE-2014-1717/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1718 page", "url": "https://www.suse.com/security/cve/CVE-2014-1718/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1719 page", "url": "https://www.suse.com/security/cve/CVE-2014-1719/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1720 page", "url": "https://www.suse.com/security/cve/CVE-2014-1720/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1721 page", "url": "https://www.suse.com/security/cve/CVE-2014-1721/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1722 page", "url": "https://www.suse.com/security/cve/CVE-2014-1722/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1723 page", "url": "https://www.suse.com/security/cve/CVE-2014-1723/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1724 page", "url": "https://www.suse.com/security/cve/CVE-2014-1724/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1725 page", "url": "https://www.suse.com/security/cve/CVE-2014-1725/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1726 page", "url": "https://www.suse.com/security/cve/CVE-2014-1726/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1727 page", "url": "https://www.suse.com/security/cve/CVE-2014-1727/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1728 page", "url": "https://www.suse.com/security/cve/CVE-2014-1728/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1729 page", "url": "https://www.suse.com/security/cve/CVE-2014-1729/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1730 page", "url": "https://www.suse.com/security/cve/CVE-2014-1730/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1731 page", "url": "https://www.suse.com/security/cve/CVE-2014-1731/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1732 page", "url": "https://www.suse.com/security/cve/CVE-2014-1732/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1733 page", "url": "https://www.suse.com/security/cve/CVE-2014-1733/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1734 page", "url": "https://www.suse.com/security/cve/CVE-2014-1734/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1735 page", "url": "https://www.suse.com/security/cve/CVE-2014-1735/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1740 page", "url": "https://www.suse.com/security/cve/CVE-2014-1740/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1741 page", "url": "https://www.suse.com/security/cve/CVE-2014-1741/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1742 page", "url": "https://www.suse.com/security/cve/CVE-2014-1742/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1743 page", "url": "https://www.suse.com/security/cve/CVE-2014-1743/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1744 page", "url": "https://www.suse.com/security/cve/CVE-2014-1744/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1745 page", "url": "https://www.suse.com/security/cve/CVE-2014-1745/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1746 page", "url": "https://www.suse.com/security/cve/CVE-2014-1746/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1747 page", "url": "https://www.suse.com/security/cve/CVE-2014-1747/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1748 page", "url": "https://www.suse.com/security/cve/CVE-2014-1748/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-1749 page", "url": "https://www.suse.com/security/cve/CVE-2014-1749/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3152 page", "url": "https://www.suse.com/security/cve/CVE-2014-3152/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3154 page", "url": "https://www.suse.com/security/cve/CVE-2014-3154/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3155 page", "url": "https://www.suse.com/security/cve/CVE-2014-3155/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3156 page", "url": "https://www.suse.com/security/cve/CVE-2014-3156/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3157 page", "url": "https://www.suse.com/security/cve/CVE-2014-3157/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3160 page", "url": "https://www.suse.com/security/cve/CVE-2014-3160/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3162 page", "url": "https://www.suse.com/security/cve/CVE-2014-3162/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3165 page", "url": "https://www.suse.com/security/cve/CVE-2014-3165/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3166 page", "url": "https://www.suse.com/security/cve/CVE-2014-3166/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3167 page", "url": "https://www.suse.com/security/cve/CVE-2014-3167/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3168 page", "url": "https://www.suse.com/security/cve/CVE-2014-3168/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3169 page", "url": "https://www.suse.com/security/cve/CVE-2014-3169/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3170 page", "url": "https://www.suse.com/security/cve/CVE-2014-3170/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3171 page", "url": "https://www.suse.com/security/cve/CVE-2014-3171/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3172 page", "url": "https://www.suse.com/security/cve/CVE-2014-3172/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3173 page", "url": "https://www.suse.com/security/cve/CVE-2014-3173/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3174 page", "url": "https://www.suse.com/security/cve/CVE-2014-3174/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3175 page", "url": "https://www.suse.com/security/cve/CVE-2014-3175/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3176 page", "url": "https://www.suse.com/security/cve/CVE-2014-3176/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3178 page", "url": "https://www.suse.com/security/cve/CVE-2014-3178/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3188 page", "url": "https://www.suse.com/security/cve/CVE-2014-3188/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3189 page", "url": "https://www.suse.com/security/cve/CVE-2014-3189/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3190 page", "url": "https://www.suse.com/security/cve/CVE-2014-3190/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3191 page", "url": "https://www.suse.com/security/cve/CVE-2014-3191/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3192 page", "url": "https://www.suse.com/security/cve/CVE-2014-3192/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3193 page", "url": "https://www.suse.com/security/cve/CVE-2014-3193/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3194 page", "url": "https://www.suse.com/security/cve/CVE-2014-3194/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3195 page", "url": "https://www.suse.com/security/cve/CVE-2014-3195/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3196 page", "url": "https://www.suse.com/security/cve/CVE-2014-3196/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3197 page", "url": "https://www.suse.com/security/cve/CVE-2014-3197/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3198 page", "url": "https://www.suse.com/security/cve/CVE-2014-3198/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3199 page", "url": "https://www.suse.com/security/cve/CVE-2014-3199/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-3200 page", "url": "https://www.suse.com/security/cve/CVE-2014-3200/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7899 page", "url": "https://www.suse.com/security/cve/CVE-2014-7899/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7900 page", "url": "https://www.suse.com/security/cve/CVE-2014-7900/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7901 page", "url": "https://www.suse.com/security/cve/CVE-2014-7901/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7902 page", "url": "https://www.suse.com/security/cve/CVE-2014-7902/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7903 page", "url": "https://www.suse.com/security/cve/CVE-2014-7903/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7904 page", "url": "https://www.suse.com/security/cve/CVE-2014-7904/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7905 page", "url": "https://www.suse.com/security/cve/CVE-2014-7905/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7906 page", "url": "https://www.suse.com/security/cve/CVE-2014-7906/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7907 page", "url": "https://www.suse.com/security/cve/CVE-2014-7907/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7908 page", "url": "https://www.suse.com/security/cve/CVE-2014-7908/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7909 page", "url": "https://www.suse.com/security/cve/CVE-2014-7909/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7910 page", "url": "https://www.suse.com/security/cve/CVE-2014-7910/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7923 page", "url": "https://www.suse.com/security/cve/CVE-2014-7923/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7924 page", "url": "https://www.suse.com/security/cve/CVE-2014-7924/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7925 page", "url": "https://www.suse.com/security/cve/CVE-2014-7925/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7926 page", "url": "https://www.suse.com/security/cve/CVE-2014-7926/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7927 page", "url": "https://www.suse.com/security/cve/CVE-2014-7927/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7928 page", "url": "https://www.suse.com/security/cve/CVE-2014-7928/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7929 page", "url": "https://www.suse.com/security/cve/CVE-2014-7929/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7930 page", "url": "https://www.suse.com/security/cve/CVE-2014-7930/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7932 page", "url": "https://www.suse.com/security/cve/CVE-2014-7932/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7933 page", "url": "https://www.suse.com/security/cve/CVE-2014-7933/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7934 page", "url": "https://www.suse.com/security/cve/CVE-2014-7934/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7935 page", "url": "https://www.suse.com/security/cve/CVE-2014-7935/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7936 page", "url": "https://www.suse.com/security/cve/CVE-2014-7936/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7937 page", "url": "https://www.suse.com/security/cve/CVE-2014-7937/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7938 page", "url": "https://www.suse.com/security/cve/CVE-2014-7938/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7939 page", "url": "https://www.suse.com/security/cve/CVE-2014-7939/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7940 page", "url": "https://www.suse.com/security/cve/CVE-2014-7940/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7941 page", "url": "https://www.suse.com/security/cve/CVE-2014-7941/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7942 page", "url": "https://www.suse.com/security/cve/CVE-2014-7942/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7943 page", "url": "https://www.suse.com/security/cve/CVE-2014-7943/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7944 page", "url": "https://www.suse.com/security/cve/CVE-2014-7944/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7945 page", "url": "https://www.suse.com/security/cve/CVE-2014-7945/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7946 page", "url": "https://www.suse.com/security/cve/CVE-2014-7946/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7947 page", "url": "https://www.suse.com/security/cve/CVE-2014-7947/" }, { "category": "self", "summary": "SUSE CVE CVE-2014-7948 page", "url": "https://www.suse.com/security/cve/CVE-2014-7948/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1205 page", "url": "https://www.suse.com/security/cve/CVE-2015-1205/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1209 page", "url": "https://www.suse.com/security/cve/CVE-2015-1209/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1210 page", "url": "https://www.suse.com/security/cve/CVE-2015-1210/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1211 page", "url": "https://www.suse.com/security/cve/CVE-2015-1211/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1212 page", "url": "https://www.suse.com/security/cve/CVE-2015-1212/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1213 page", "url": "https://www.suse.com/security/cve/CVE-2015-1213/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1214 page", "url": "https://www.suse.com/security/cve/CVE-2015-1214/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1215 page", "url": "https://www.suse.com/security/cve/CVE-2015-1215/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1216 page", "url": "https://www.suse.com/security/cve/CVE-2015-1216/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1217 page", "url": "https://www.suse.com/security/cve/CVE-2015-1217/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1218 page", "url": "https://www.suse.com/security/cve/CVE-2015-1218/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1219 page", "url": "https://www.suse.com/security/cve/CVE-2015-1219/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1220 page", "url": "https://www.suse.com/security/cve/CVE-2015-1220/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1221 page", "url": "https://www.suse.com/security/cve/CVE-2015-1221/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1222 page", "url": "https://www.suse.com/security/cve/CVE-2015-1222/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1223 page", "url": "https://www.suse.com/security/cve/CVE-2015-1223/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1224 page", "url": "https://www.suse.com/security/cve/CVE-2015-1224/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1225 page", "url": "https://www.suse.com/security/cve/CVE-2015-1225/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1226 page", "url": "https://www.suse.com/security/cve/CVE-2015-1226/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1227 page", "url": "https://www.suse.com/security/cve/CVE-2015-1227/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1228 page", "url": "https://www.suse.com/security/cve/CVE-2015-1228/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1229 page", "url": "https://www.suse.com/security/cve/CVE-2015-1229/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1230 page", "url": "https://www.suse.com/security/cve/CVE-2015-1230/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1231 page", "url": "https://www.suse.com/security/cve/CVE-2015-1231/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1233 page", "url": "https://www.suse.com/security/cve/CVE-2015-1233/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1234 page", "url": "https://www.suse.com/security/cve/CVE-2015-1234/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1235 page", "url": "https://www.suse.com/security/cve/CVE-2015-1235/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1236 page", "url": "https://www.suse.com/security/cve/CVE-2015-1236/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1237 page", "url": "https://www.suse.com/security/cve/CVE-2015-1237/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1238 page", "url": "https://www.suse.com/security/cve/CVE-2015-1238/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1240 page", "url": "https://www.suse.com/security/cve/CVE-2015-1240/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1241 page", "url": "https://www.suse.com/security/cve/CVE-2015-1241/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1242 page", "url": "https://www.suse.com/security/cve/CVE-2015-1242/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1243 page", "url": "https://www.suse.com/security/cve/CVE-2015-1243/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1244 page", "url": "https://www.suse.com/security/cve/CVE-2015-1244/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1245 page", "url": "https://www.suse.com/security/cve/CVE-2015-1245/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1246 page", "url": "https://www.suse.com/security/cve/CVE-2015-1246/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1247 page", "url": "https://www.suse.com/security/cve/CVE-2015-1247/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1248 page", "url": "https://www.suse.com/security/cve/CVE-2015-1248/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1249 page", "url": "https://www.suse.com/security/cve/CVE-2015-1249/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1250 page", "url": "https://www.suse.com/security/cve/CVE-2015-1250/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1251 page", "url": "https://www.suse.com/security/cve/CVE-2015-1251/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1252 page", "url": "https://www.suse.com/security/cve/CVE-2015-1252/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1253 page", "url": "https://www.suse.com/security/cve/CVE-2015-1253/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1254 page", "url": "https://www.suse.com/security/cve/CVE-2015-1254/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1255 page", "url": "https://www.suse.com/security/cve/CVE-2015-1255/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1256 page", "url": "https://www.suse.com/security/cve/CVE-2015-1256/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1257 page", "url": "https://www.suse.com/security/cve/CVE-2015-1257/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1258 page", "url": "https://www.suse.com/security/cve/CVE-2015-1258/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1259 page", "url": "https://www.suse.com/security/cve/CVE-2015-1259/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1260 page", "url": "https://www.suse.com/security/cve/CVE-2015-1260/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1261 page", "url": "https://www.suse.com/security/cve/CVE-2015-1261/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1262 page", "url": "https://www.suse.com/security/cve/CVE-2015-1262/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1263 page", "url": "https://www.suse.com/security/cve/CVE-2015-1263/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1264 page", "url": "https://www.suse.com/security/cve/CVE-2015-1264/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1265 page", "url": "https://www.suse.com/security/cve/CVE-2015-1265/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1266 page", "url": "https://www.suse.com/security/cve/CVE-2015-1266/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1267 page", "url": "https://www.suse.com/security/cve/CVE-2015-1267/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1268 page", "url": "https://www.suse.com/security/cve/CVE-2015-1268/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1269 page", "url": "https://www.suse.com/security/cve/CVE-2015-1269/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1270 page", "url": "https://www.suse.com/security/cve/CVE-2015-1270/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1271 page", "url": "https://www.suse.com/security/cve/CVE-2015-1271/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1272 page", "url": "https://www.suse.com/security/cve/CVE-2015-1272/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1273 page", "url": "https://www.suse.com/security/cve/CVE-2015-1273/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1274 page", "url": "https://www.suse.com/security/cve/CVE-2015-1274/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1275 page", "url": "https://www.suse.com/security/cve/CVE-2015-1275/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1276 page", "url": "https://www.suse.com/security/cve/CVE-2015-1276/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1277 page", "url": "https://www.suse.com/security/cve/CVE-2015-1277/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1278 page", "url": "https://www.suse.com/security/cve/CVE-2015-1278/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1279 page", "url": "https://www.suse.com/security/cve/CVE-2015-1279/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1280 page", "url": "https://www.suse.com/security/cve/CVE-2015-1280/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1281 page", "url": "https://www.suse.com/security/cve/CVE-2015-1281/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1282 page", "url": "https://www.suse.com/security/cve/CVE-2015-1282/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1283 page", "url": "https://www.suse.com/security/cve/CVE-2015-1283/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1284 page", "url": "https://www.suse.com/security/cve/CVE-2015-1284/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1285 page", "url": "https://www.suse.com/security/cve/CVE-2015-1285/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1286 page", "url": "https://www.suse.com/security/cve/CVE-2015-1286/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1287 page", "url": "https://www.suse.com/security/cve/CVE-2015-1287/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1288 page", "url": "https://www.suse.com/security/cve/CVE-2015-1288/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1289 page", "url": "https://www.suse.com/security/cve/CVE-2015-1289/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1291 page", "url": "https://www.suse.com/security/cve/CVE-2015-1291/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1292 page", "url": "https://www.suse.com/security/cve/CVE-2015-1292/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1293 page", "url": "https://www.suse.com/security/cve/CVE-2015-1293/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1294 page", "url": "https://www.suse.com/security/cve/CVE-2015-1294/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1295 page", "url": "https://www.suse.com/security/cve/CVE-2015-1295/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1296 page", "url": "https://www.suse.com/security/cve/CVE-2015-1296/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1297 page", "url": "https://www.suse.com/security/cve/CVE-2015-1297/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1298 page", "url": "https://www.suse.com/security/cve/CVE-2015-1298/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1299 page", "url": "https://www.suse.com/security/cve/CVE-2015-1299/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1300 page", "url": "https://www.suse.com/security/cve/CVE-2015-1300/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1301 page", "url": "https://www.suse.com/security/cve/CVE-2015-1301/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1302 page", "url": "https://www.suse.com/security/cve/CVE-2015-1302/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1303 page", "url": "https://www.suse.com/security/cve/CVE-2015-1303/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-1304 page", "url": "https://www.suse.com/security/cve/CVE-2015-1304/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6755 page", "url": "https://www.suse.com/security/cve/CVE-2015-6755/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6756 page", "url": "https://www.suse.com/security/cve/CVE-2015-6756/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6757 page", "url": "https://www.suse.com/security/cve/CVE-2015-6757/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6758 page", "url": "https://www.suse.com/security/cve/CVE-2015-6758/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6759 page", "url": "https://www.suse.com/security/cve/CVE-2015-6759/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6760 page", "url": "https://www.suse.com/security/cve/CVE-2015-6760/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6761 page", "url": "https://www.suse.com/security/cve/CVE-2015-6761/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6762 page", "url": "https://www.suse.com/security/cve/CVE-2015-6762/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6763 page", "url": "https://www.suse.com/security/cve/CVE-2015-6763/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6764 page", "url": "https://www.suse.com/security/cve/CVE-2015-6764/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6765 page", "url": "https://www.suse.com/security/cve/CVE-2015-6765/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6766 page", "url": "https://www.suse.com/security/cve/CVE-2015-6766/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6767 page", "url": "https://www.suse.com/security/cve/CVE-2015-6767/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6768 page", "url": "https://www.suse.com/security/cve/CVE-2015-6768/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6769 page", "url": "https://www.suse.com/security/cve/CVE-2015-6769/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6770 page", "url": "https://www.suse.com/security/cve/CVE-2015-6770/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6771 page", "url": "https://www.suse.com/security/cve/CVE-2015-6771/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6772 page", "url": "https://www.suse.com/security/cve/CVE-2015-6772/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6773 page", "url": "https://www.suse.com/security/cve/CVE-2015-6773/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6774 page", "url": "https://www.suse.com/security/cve/CVE-2015-6774/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6775 page", "url": "https://www.suse.com/security/cve/CVE-2015-6775/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6776 page", "url": "https://www.suse.com/security/cve/CVE-2015-6776/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6777 page", "url": "https://www.suse.com/security/cve/CVE-2015-6777/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6778 page", "url": "https://www.suse.com/security/cve/CVE-2015-6778/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6779 page", "url": "https://www.suse.com/security/cve/CVE-2015-6779/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6780 page", "url": "https://www.suse.com/security/cve/CVE-2015-6780/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6781 page", "url": "https://www.suse.com/security/cve/CVE-2015-6781/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6782 page", "url": "https://www.suse.com/security/cve/CVE-2015-6782/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6783 page", "url": "https://www.suse.com/security/cve/CVE-2015-6783/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6784 page", "url": "https://www.suse.com/security/cve/CVE-2015-6784/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6785 page", "url": "https://www.suse.com/security/cve/CVE-2015-6785/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6786 page", "url": "https://www.suse.com/security/cve/CVE-2015-6786/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6787 page", "url": "https://www.suse.com/security/cve/CVE-2015-6787/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6788 page", "url": "https://www.suse.com/security/cve/CVE-2015-6788/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6789 page", "url": "https://www.suse.com/security/cve/CVE-2015-6789/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6790 page", "url": "https://www.suse.com/security/cve/CVE-2015-6790/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6791 page", "url": "https://www.suse.com/security/cve/CVE-2015-6791/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-6792 page", "url": "https://www.suse.com/security/cve/CVE-2015-6792/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-7834 page", "url": "https://www.suse.com/security/cve/CVE-2015-7834/" }, { "category": "self", "summary": "SUSE CVE CVE-2015-8126 page", "url": "https://www.suse.com/security/cve/CVE-2015-8126/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1612 page", "url": "https://www.suse.com/security/cve/CVE-2016-1612/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1613 page", "url": "https://www.suse.com/security/cve/CVE-2016-1613/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1614 page", "url": "https://www.suse.com/security/cve/CVE-2016-1614/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1615 page", "url": "https://www.suse.com/security/cve/CVE-2016-1615/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1616 page", "url": "https://www.suse.com/security/cve/CVE-2016-1616/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1617 page", "url": "https://www.suse.com/security/cve/CVE-2016-1617/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1618 page", "url": "https://www.suse.com/security/cve/CVE-2016-1618/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1619 page", "url": "https://www.suse.com/security/cve/CVE-2016-1619/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1620 page", "url": "https://www.suse.com/security/cve/CVE-2016-1620/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1622 page", "url": "https://www.suse.com/security/cve/CVE-2016-1622/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1623 page", "url": "https://www.suse.com/security/cve/CVE-2016-1623/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1624 page", "url": "https://www.suse.com/security/cve/CVE-2016-1624/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1625 page", "url": "https://www.suse.com/security/cve/CVE-2016-1625/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1626 page", "url": "https://www.suse.com/security/cve/CVE-2016-1626/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1627 page", "url": "https://www.suse.com/security/cve/CVE-2016-1627/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1629 page", "url": "https://www.suse.com/security/cve/CVE-2016-1629/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1630 page", "url": "https://www.suse.com/security/cve/CVE-2016-1630/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1631 page", "url": "https://www.suse.com/security/cve/CVE-2016-1631/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1632 page", "url": "https://www.suse.com/security/cve/CVE-2016-1632/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1633 page", "url": "https://www.suse.com/security/cve/CVE-2016-1633/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1634 page", "url": "https://www.suse.com/security/cve/CVE-2016-1634/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1635 page", "url": "https://www.suse.com/security/cve/CVE-2016-1635/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1636 page", "url": "https://www.suse.com/security/cve/CVE-2016-1636/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1637 page", "url": "https://www.suse.com/security/cve/CVE-2016-1637/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1638 page", "url": "https://www.suse.com/security/cve/CVE-2016-1638/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1639 page", "url": "https://www.suse.com/security/cve/CVE-2016-1639/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1640 page", "url": "https://www.suse.com/security/cve/CVE-2016-1640/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1641 page", "url": "https://www.suse.com/security/cve/CVE-2016-1641/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1642 page", "url": "https://www.suse.com/security/cve/CVE-2016-1642/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1643 page", "url": "https://www.suse.com/security/cve/CVE-2016-1643/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1644 page", "url": "https://www.suse.com/security/cve/CVE-2016-1644/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1645 page", "url": "https://www.suse.com/security/cve/CVE-2016-1645/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1646 page", "url": "https://www.suse.com/security/cve/CVE-2016-1646/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1647 page", "url": "https://www.suse.com/security/cve/CVE-2016-1647/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1648 page", "url": "https://www.suse.com/security/cve/CVE-2016-1648/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1649 page", "url": "https://www.suse.com/security/cve/CVE-2016-1649/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1650 page", "url": "https://www.suse.com/security/cve/CVE-2016-1650/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1651 page", "url": "https://www.suse.com/security/cve/CVE-2016-1651/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1652 page", "url": "https://www.suse.com/security/cve/CVE-2016-1652/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1653 page", "url": "https://www.suse.com/security/cve/CVE-2016-1653/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1654 page", "url": "https://www.suse.com/security/cve/CVE-2016-1654/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1655 page", "url": "https://www.suse.com/security/cve/CVE-2016-1655/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1656 page", "url": "https://www.suse.com/security/cve/CVE-2016-1656/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1657 page", "url": "https://www.suse.com/security/cve/CVE-2016-1657/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1658 page", "url": "https://www.suse.com/security/cve/CVE-2016-1658/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1659 page", "url": "https://www.suse.com/security/cve/CVE-2016-1659/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1660 page", "url": "https://www.suse.com/security/cve/CVE-2016-1660/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1661 page", "url": "https://www.suse.com/security/cve/CVE-2016-1661/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1662 page", "url": "https://www.suse.com/security/cve/CVE-2016-1662/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1663 page", "url": "https://www.suse.com/security/cve/CVE-2016-1663/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1664 page", "url": "https://www.suse.com/security/cve/CVE-2016-1664/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1665 page", "url": "https://www.suse.com/security/cve/CVE-2016-1665/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1666 page", "url": "https://www.suse.com/security/cve/CVE-2016-1666/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1667 page", "url": "https://www.suse.com/security/cve/CVE-2016-1667/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1668 page", "url": "https://www.suse.com/security/cve/CVE-2016-1668/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1669 page", "url": "https://www.suse.com/security/cve/CVE-2016-1669/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1670 page", "url": "https://www.suse.com/security/cve/CVE-2016-1670/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1672 page", "url": "https://www.suse.com/security/cve/CVE-2016-1672/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1673 page", "url": "https://www.suse.com/security/cve/CVE-2016-1673/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1674 page", "url": "https://www.suse.com/security/cve/CVE-2016-1674/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1675 page", "url": "https://www.suse.com/security/cve/CVE-2016-1675/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1676 page", "url": "https://www.suse.com/security/cve/CVE-2016-1676/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1677 page", "url": "https://www.suse.com/security/cve/CVE-2016-1677/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1678 page", "url": "https://www.suse.com/security/cve/CVE-2016-1678/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1679 page", "url": "https://www.suse.com/security/cve/CVE-2016-1679/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1680 page", "url": "https://www.suse.com/security/cve/CVE-2016-1680/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1681 page", "url": "https://www.suse.com/security/cve/CVE-2016-1681/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1682 page", "url": "https://www.suse.com/security/cve/CVE-2016-1682/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1683 page", "url": "https://www.suse.com/security/cve/CVE-2016-1683/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1684 page", "url": "https://www.suse.com/security/cve/CVE-2016-1684/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1685 page", "url": "https://www.suse.com/security/cve/CVE-2016-1685/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1686 page", "url": "https://www.suse.com/security/cve/CVE-2016-1686/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1687 page", "url": "https://www.suse.com/security/cve/CVE-2016-1687/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1688 page", "url": "https://www.suse.com/security/cve/CVE-2016-1688/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1689 page", "url": "https://www.suse.com/security/cve/CVE-2016-1689/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1690 page", "url": "https://www.suse.com/security/cve/CVE-2016-1690/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1691 page", "url": "https://www.suse.com/security/cve/CVE-2016-1691/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1692 page", "url": "https://www.suse.com/security/cve/CVE-2016-1692/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1693 page", "url": "https://www.suse.com/security/cve/CVE-2016-1693/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1694 page", "url": "https://www.suse.com/security/cve/CVE-2016-1694/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1695 page", "url": "https://www.suse.com/security/cve/CVE-2016-1695/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1696 page", "url": "https://www.suse.com/security/cve/CVE-2016-1696/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1697 page", "url": "https://www.suse.com/security/cve/CVE-2016-1697/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1698 page", "url": "https://www.suse.com/security/cve/CVE-2016-1698/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1699 page", "url": "https://www.suse.com/security/cve/CVE-2016-1699/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1700 page", "url": "https://www.suse.com/security/cve/CVE-2016-1700/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1701 page", "url": "https://www.suse.com/security/cve/CVE-2016-1701/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1702 page", "url": "https://www.suse.com/security/cve/CVE-2016-1702/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1703 page", "url": "https://www.suse.com/security/cve/CVE-2016-1703/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1704 page", "url": "https://www.suse.com/security/cve/CVE-2016-1704/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1705 page", "url": "https://www.suse.com/security/cve/CVE-2016-1705/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1706 page", "url": "https://www.suse.com/security/cve/CVE-2016-1706/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1707 page", "url": "https://www.suse.com/security/cve/CVE-2016-1707/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1708 page", "url": "https://www.suse.com/security/cve/CVE-2016-1708/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1709 page", "url": "https://www.suse.com/security/cve/CVE-2016-1709/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1710 page", "url": "https://www.suse.com/security/cve/CVE-2016-1710/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-1711 page", "url": "https://www.suse.com/security/cve/CVE-2016-1711/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-3679 page", "url": "https://www.suse.com/security/cve/CVE-2016-3679/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5127 page", "url": "https://www.suse.com/security/cve/CVE-2016-5127/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5128 page", "url": "https://www.suse.com/security/cve/CVE-2016-5128/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5129 page", "url": "https://www.suse.com/security/cve/CVE-2016-5129/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5130 page", "url": "https://www.suse.com/security/cve/CVE-2016-5130/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5131 page", "url": "https://www.suse.com/security/cve/CVE-2016-5131/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5132 page", "url": "https://www.suse.com/security/cve/CVE-2016-5132/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5133 page", "url": "https://www.suse.com/security/cve/CVE-2016-5133/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5134 page", "url": "https://www.suse.com/security/cve/CVE-2016-5134/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5135 page", "url": "https://www.suse.com/security/cve/CVE-2016-5135/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5136 page", "url": "https://www.suse.com/security/cve/CVE-2016-5136/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5137 page", "url": "https://www.suse.com/security/cve/CVE-2016-5137/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5139 page", "url": "https://www.suse.com/security/cve/CVE-2016-5139/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5140 page", "url": "https://www.suse.com/security/cve/CVE-2016-5140/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5141 page", "url": "https://www.suse.com/security/cve/CVE-2016-5141/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5142 page", "url": "https://www.suse.com/security/cve/CVE-2016-5142/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5143 page", "url": "https://www.suse.com/security/cve/CVE-2016-5143/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5144 page", "url": "https://www.suse.com/security/cve/CVE-2016-5144/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5145 page", "url": "https://www.suse.com/security/cve/CVE-2016-5145/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5146 page", "url": "https://www.suse.com/security/cve/CVE-2016-5146/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5147 page", "url": "https://www.suse.com/security/cve/CVE-2016-5147/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5148 page", "url": "https://www.suse.com/security/cve/CVE-2016-5148/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5149 page", "url": "https://www.suse.com/security/cve/CVE-2016-5149/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5150 page", "url": "https://www.suse.com/security/cve/CVE-2016-5150/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5151 page", "url": "https://www.suse.com/security/cve/CVE-2016-5151/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5152 page", "url": "https://www.suse.com/security/cve/CVE-2016-5152/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5153 page", "url": "https://www.suse.com/security/cve/CVE-2016-5153/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5154 page", "url": "https://www.suse.com/security/cve/CVE-2016-5154/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5155 page", "url": "https://www.suse.com/security/cve/CVE-2016-5155/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5156 page", "url": "https://www.suse.com/security/cve/CVE-2016-5156/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5157 page", "url": "https://www.suse.com/security/cve/CVE-2016-5157/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5158 page", "url": "https://www.suse.com/security/cve/CVE-2016-5158/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5159 page", "url": "https://www.suse.com/security/cve/CVE-2016-5159/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5160 page", "url": "https://www.suse.com/security/cve/CVE-2016-5160/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5161 page", "url": "https://www.suse.com/security/cve/CVE-2016-5161/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5162 page", "url": "https://www.suse.com/security/cve/CVE-2016-5162/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5163 page", "url": "https://www.suse.com/security/cve/CVE-2016-5163/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5164 page", "url": "https://www.suse.com/security/cve/CVE-2016-5164/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5165 page", "url": "https://www.suse.com/security/cve/CVE-2016-5165/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5166 page", "url": "https://www.suse.com/security/cve/CVE-2016-5166/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5170 page", "url": "https://www.suse.com/security/cve/CVE-2016-5170/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5171 page", "url": "https://www.suse.com/security/cve/CVE-2016-5171/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5172 page", "url": "https://www.suse.com/security/cve/CVE-2016-5172/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5173 page", "url": "https://www.suse.com/security/cve/CVE-2016-5173/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5174 page", "url": "https://www.suse.com/security/cve/CVE-2016-5174/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5175 page", "url": "https://www.suse.com/security/cve/CVE-2016-5175/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5177 page", "url": "https://www.suse.com/security/cve/CVE-2016-5177/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5178 page", "url": "https://www.suse.com/security/cve/CVE-2016-5178/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5181 page", "url": "https://www.suse.com/security/cve/CVE-2016-5181/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5182 page", "url": "https://www.suse.com/security/cve/CVE-2016-5182/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5183 page", "url": "https://www.suse.com/security/cve/CVE-2016-5183/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5184 page", "url": "https://www.suse.com/security/cve/CVE-2016-5184/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5185 page", "url": "https://www.suse.com/security/cve/CVE-2016-5185/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5186 page", "url": "https://www.suse.com/security/cve/CVE-2016-5186/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5187 page", "url": "https://www.suse.com/security/cve/CVE-2016-5187/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5188 page", "url": "https://www.suse.com/security/cve/CVE-2016-5188/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5189 page", "url": "https://www.suse.com/security/cve/CVE-2016-5189/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5190 page", "url": "https://www.suse.com/security/cve/CVE-2016-5190/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5191 page", "url": "https://www.suse.com/security/cve/CVE-2016-5191/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5192 page", "url": "https://www.suse.com/security/cve/CVE-2016-5192/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5193 page", "url": "https://www.suse.com/security/cve/CVE-2016-5193/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5198 page", "url": "https://www.suse.com/security/cve/CVE-2016-5198/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5199 page", "url": "https://www.suse.com/security/cve/CVE-2016-5199/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5200 page", "url": "https://www.suse.com/security/cve/CVE-2016-5200/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5201 page", "url": "https://www.suse.com/security/cve/CVE-2016-5201/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5202 page", "url": "https://www.suse.com/security/cve/CVE-2016-5202/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5204 page", "url": "https://www.suse.com/security/cve/CVE-2016-5204/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5211 page", "url": "https://www.suse.com/security/cve/CVE-2016-5211/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5217 page", "url": "https://www.suse.com/security/cve/CVE-2016-5217/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5222 page", "url": "https://www.suse.com/security/cve/CVE-2016-5222/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-5224 page", "url": "https://www.suse.com/security/cve/CVE-2016-5224/" }, { "category": "self", "summary": "SUSE CVE CVE-2016-9651 page", "url": "https://www.suse.com/security/cve/CVE-2016-9651/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-11215 page", "url": "https://www.suse.com/security/cve/CVE-2017-11215/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-11225 page", "url": "https://www.suse.com/security/cve/CVE-2017-11225/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15386 page", "url": "https://www.suse.com/security/cve/CVE-2017-15386/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15387 page", "url": "https://www.suse.com/security/cve/CVE-2017-15387/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15388 page", "url": "https://www.suse.com/security/cve/CVE-2017-15388/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15389 page", "url": "https://www.suse.com/security/cve/CVE-2017-15389/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15390 page", "url": "https://www.suse.com/security/cve/CVE-2017-15390/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15391 page", "url": "https://www.suse.com/security/cve/CVE-2017-15391/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15392 page", "url": "https://www.suse.com/security/cve/CVE-2017-15392/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15393 page", "url": "https://www.suse.com/security/cve/CVE-2017-15393/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15394 page", "url": "https://www.suse.com/security/cve/CVE-2017-15394/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15395 page", "url": "https://www.suse.com/security/cve/CVE-2017-15395/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15396 page", "url": "https://www.suse.com/security/cve/CVE-2017-15396/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15398 page", "url": "https://www.suse.com/security/cve/CVE-2017-15398/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15399 page", "url": "https://www.suse.com/security/cve/CVE-2017-15399/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15407 page", "url": "https://www.suse.com/security/cve/CVE-2017-15407/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15408 page", "url": "https://www.suse.com/security/cve/CVE-2017-15408/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15409 page", "url": "https://www.suse.com/security/cve/CVE-2017-15409/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15410 page", "url": "https://www.suse.com/security/cve/CVE-2017-15410/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15411 page", "url": "https://www.suse.com/security/cve/CVE-2017-15411/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15412 page", "url": "https://www.suse.com/security/cve/CVE-2017-15412/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15413 page", "url": "https://www.suse.com/security/cve/CVE-2017-15413/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15415 page", "url": "https://www.suse.com/security/cve/CVE-2017-15415/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15416 page", "url": "https://www.suse.com/security/cve/CVE-2017-15416/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15417 page", "url": "https://www.suse.com/security/cve/CVE-2017-15417/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15418 page", "url": "https://www.suse.com/security/cve/CVE-2017-15418/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15419 page", "url": "https://www.suse.com/security/cve/CVE-2017-15419/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15420 page", "url": "https://www.suse.com/security/cve/CVE-2017-15420/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15422 page", "url": "https://www.suse.com/security/cve/CVE-2017-15422/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15423 page", "url": "https://www.suse.com/security/cve/CVE-2017-15423/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15424 page", "url": "https://www.suse.com/security/cve/CVE-2017-15424/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15425 page", "url": "https://www.suse.com/security/cve/CVE-2017-15425/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15426 page", "url": "https://www.suse.com/security/cve/CVE-2017-15426/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15427 page", "url": "https://www.suse.com/security/cve/CVE-2017-15427/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15429 page", "url": "https://www.suse.com/security/cve/CVE-2017-15429/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-15430 page", "url": "https://www.suse.com/security/cve/CVE-2017-15430/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5006 page", "url": "https://www.suse.com/security/cve/CVE-2017-5006/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5007 page", "url": "https://www.suse.com/security/cve/CVE-2017-5007/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5008 page", "url": "https://www.suse.com/security/cve/CVE-2017-5008/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5009 page", "url": "https://www.suse.com/security/cve/CVE-2017-5009/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5010 page", "url": "https://www.suse.com/security/cve/CVE-2017-5010/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5011 page", "url": "https://www.suse.com/security/cve/CVE-2017-5011/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5012 page", "url": "https://www.suse.com/security/cve/CVE-2017-5012/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5013 page", "url": "https://www.suse.com/security/cve/CVE-2017-5013/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5014 page", "url": "https://www.suse.com/security/cve/CVE-2017-5014/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5015 page", "url": "https://www.suse.com/security/cve/CVE-2017-5015/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5016 page", "url": "https://www.suse.com/security/cve/CVE-2017-5016/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5017 page", "url": "https://www.suse.com/security/cve/CVE-2017-5017/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5018 page", "url": "https://www.suse.com/security/cve/CVE-2017-5018/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5019 page", "url": "https://www.suse.com/security/cve/CVE-2017-5019/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5020 page", "url": "https://www.suse.com/security/cve/CVE-2017-5020/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5021 page", "url": "https://www.suse.com/security/cve/CVE-2017-5021/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5022 page", "url": "https://www.suse.com/security/cve/CVE-2017-5022/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5023 page", "url": "https://www.suse.com/security/cve/CVE-2017-5023/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5024 page", "url": "https://www.suse.com/security/cve/CVE-2017-5024/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5025 page", "url": "https://www.suse.com/security/cve/CVE-2017-5025/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5026 page", "url": "https://www.suse.com/security/cve/CVE-2017-5026/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5030 page", "url": "https://www.suse.com/security/cve/CVE-2017-5030/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5035 page", "url": "https://www.suse.com/security/cve/CVE-2017-5035/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5041 page", "url": "https://www.suse.com/security/cve/CVE-2017-5041/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5044 page", "url": "https://www.suse.com/security/cve/CVE-2017-5044/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5052 page", "url": "https://www.suse.com/security/cve/CVE-2017-5052/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5053 page", "url": "https://www.suse.com/security/cve/CVE-2017-5053/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5054 page", "url": "https://www.suse.com/security/cve/CVE-2017-5054/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5055 page", "url": "https://www.suse.com/security/cve/CVE-2017-5055/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5056 page", "url": "https://www.suse.com/security/cve/CVE-2017-5056/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5057 page", "url": "https://www.suse.com/security/cve/CVE-2017-5057/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5058 page", "url": "https://www.suse.com/security/cve/CVE-2017-5058/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5059 page", "url": "https://www.suse.com/security/cve/CVE-2017-5059/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5060 page", "url": "https://www.suse.com/security/cve/CVE-2017-5060/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5061 page", "url": "https://www.suse.com/security/cve/CVE-2017-5061/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5062 page", "url": "https://www.suse.com/security/cve/CVE-2017-5062/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5063 page", "url": "https://www.suse.com/security/cve/CVE-2017-5063/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5064 page", "url": "https://www.suse.com/security/cve/CVE-2017-5064/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5065 page", "url": "https://www.suse.com/security/cve/CVE-2017-5065/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5066 page", "url": "https://www.suse.com/security/cve/CVE-2017-5066/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5067 page", "url": "https://www.suse.com/security/cve/CVE-2017-5067/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5068 page", "url": "https://www.suse.com/security/cve/CVE-2017-5068/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5069 page", "url": "https://www.suse.com/security/cve/CVE-2017-5069/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5070 page", "url": "https://www.suse.com/security/cve/CVE-2017-5070/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5071 page", "url": "https://www.suse.com/security/cve/CVE-2017-5071/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5072 page", "url": "https://www.suse.com/security/cve/CVE-2017-5072/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5073 page", "url": "https://www.suse.com/security/cve/CVE-2017-5073/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5074 page", "url": "https://www.suse.com/security/cve/CVE-2017-5074/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5075 page", "url": "https://www.suse.com/security/cve/CVE-2017-5075/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5076 page", "url": "https://www.suse.com/security/cve/CVE-2017-5076/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5077 page", "url": "https://www.suse.com/security/cve/CVE-2017-5077/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5078 page", "url": "https://www.suse.com/security/cve/CVE-2017-5078/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5079 page", "url": "https://www.suse.com/security/cve/CVE-2017-5079/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5080 page", "url": "https://www.suse.com/security/cve/CVE-2017-5080/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5081 page", "url": "https://www.suse.com/security/cve/CVE-2017-5081/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5082 page", "url": "https://www.suse.com/security/cve/CVE-2017-5082/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5083 page", "url": "https://www.suse.com/security/cve/CVE-2017-5083/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5085 page", "url": "https://www.suse.com/security/cve/CVE-2017-5085/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5086 page", "url": "https://www.suse.com/security/cve/CVE-2017-5086/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5087 page", "url": "https://www.suse.com/security/cve/CVE-2017-5087/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5088 page", "url": "https://www.suse.com/security/cve/CVE-2017-5088/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5089 page", "url": "https://www.suse.com/security/cve/CVE-2017-5089/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5091 page", "url": "https://www.suse.com/security/cve/CVE-2017-5091/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5092 page", "url": "https://www.suse.com/security/cve/CVE-2017-5092/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5093 page", "url": "https://www.suse.com/security/cve/CVE-2017-5093/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5094 page", "url": "https://www.suse.com/security/cve/CVE-2017-5094/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5095 page", "url": "https://www.suse.com/security/cve/CVE-2017-5095/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5096 page", "url": "https://www.suse.com/security/cve/CVE-2017-5096/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5097 page", "url": "https://www.suse.com/security/cve/CVE-2017-5097/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5098 page", "url": "https://www.suse.com/security/cve/CVE-2017-5098/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5099 page", "url": "https://www.suse.com/security/cve/CVE-2017-5099/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5100 page", "url": "https://www.suse.com/security/cve/CVE-2017-5100/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5101 page", "url": "https://www.suse.com/security/cve/CVE-2017-5101/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5102 page", "url": "https://www.suse.com/security/cve/CVE-2017-5102/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5103 page", "url": "https://www.suse.com/security/cve/CVE-2017-5103/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5104 page", "url": "https://www.suse.com/security/cve/CVE-2017-5104/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5105 page", "url": "https://www.suse.com/security/cve/CVE-2017-5105/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5106 page", "url": "https://www.suse.com/security/cve/CVE-2017-5106/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5107 page", "url": "https://www.suse.com/security/cve/CVE-2017-5107/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5108 page", "url": "https://www.suse.com/security/cve/CVE-2017-5108/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5109 page", "url": "https://www.suse.com/security/cve/CVE-2017-5109/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5110 page", "url": "https://www.suse.com/security/cve/CVE-2017-5110/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5111 page", "url": "https://www.suse.com/security/cve/CVE-2017-5111/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5112 page", "url": "https://www.suse.com/security/cve/CVE-2017-5112/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5113 page", "url": "https://www.suse.com/security/cve/CVE-2017-5113/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5114 page", "url": "https://www.suse.com/security/cve/CVE-2017-5114/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5115 page", "url": "https://www.suse.com/security/cve/CVE-2017-5115/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5116 page", "url": "https://www.suse.com/security/cve/CVE-2017-5116/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5117 page", "url": "https://www.suse.com/security/cve/CVE-2017-5117/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5118 page", "url": "https://www.suse.com/security/cve/CVE-2017-5118/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5119 page", "url": "https://www.suse.com/security/cve/CVE-2017-5119/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5120 page", "url": "https://www.suse.com/security/cve/CVE-2017-5120/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5121 page", "url": "https://www.suse.com/security/cve/CVE-2017-5121/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5122 page", "url": "https://www.suse.com/security/cve/CVE-2017-5122/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5124 page", "url": "https://www.suse.com/security/cve/CVE-2017-5124/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5125 page", "url": "https://www.suse.com/security/cve/CVE-2017-5125/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5126 page", "url": "https://www.suse.com/security/cve/CVE-2017-5126/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5127 page", "url": "https://www.suse.com/security/cve/CVE-2017-5127/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5128 page", "url": "https://www.suse.com/security/cve/CVE-2017-5128/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5129 page", "url": "https://www.suse.com/security/cve/CVE-2017-5129/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5130 page", "url": "https://www.suse.com/security/cve/CVE-2017-5130/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5131 page", "url": "https://www.suse.com/security/cve/CVE-2017-5131/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5132 page", "url": "https://www.suse.com/security/cve/CVE-2017-5132/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-5133 page", "url": "https://www.suse.com/security/cve/CVE-2017-5133/" }, { "category": "self", "summary": "SUSE CVE CVE-2017-7000 page", "url": "https://www.suse.com/security/cve/CVE-2017-7000/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16065 page", "url": "https://www.suse.com/security/cve/CVE-2018-16065/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16066 page", "url": "https://www.suse.com/security/cve/CVE-2018-16066/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16067 page", "url": "https://www.suse.com/security/cve/CVE-2018-16067/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16068 page", "url": "https://www.suse.com/security/cve/CVE-2018-16068/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16069 page", "url": "https://www.suse.com/security/cve/CVE-2018-16069/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16070 page", "url": "https://www.suse.com/security/cve/CVE-2018-16070/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16071 page", "url": "https://www.suse.com/security/cve/CVE-2018-16071/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16073 page", "url": "https://www.suse.com/security/cve/CVE-2018-16073/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16074 page", "url": "https://www.suse.com/security/cve/CVE-2018-16074/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16075 page", "url": "https://www.suse.com/security/cve/CVE-2018-16075/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16076 page", "url": "https://www.suse.com/security/cve/CVE-2018-16076/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16077 page", "url": "https://www.suse.com/security/cve/CVE-2018-16077/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16078 page", "url": "https://www.suse.com/security/cve/CVE-2018-16078/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16079 page", "url": "https://www.suse.com/security/cve/CVE-2018-16079/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16080 page", "url": "https://www.suse.com/security/cve/CVE-2018-16080/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16081 page", "url": "https://www.suse.com/security/cve/CVE-2018-16081/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16082 page", "url": "https://www.suse.com/security/cve/CVE-2018-16082/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16083 page", "url": "https://www.suse.com/security/cve/CVE-2018-16083/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16084 page", "url": "https://www.suse.com/security/cve/CVE-2018-16084/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16085 page", "url": "https://www.suse.com/security/cve/CVE-2018-16085/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16086 page", "url": "https://www.suse.com/security/cve/CVE-2018-16086/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16087 page", "url": "https://www.suse.com/security/cve/CVE-2018-16087/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-16088 page", "url": "https://www.suse.com/security/cve/CVE-2018-16088/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17462 page", "url": "https://www.suse.com/security/cve/CVE-2018-17462/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17463 page", "url": "https://www.suse.com/security/cve/CVE-2018-17463/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17464 page", "url": "https://www.suse.com/security/cve/CVE-2018-17464/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17465 page", "url": "https://www.suse.com/security/cve/CVE-2018-17465/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17466 page", "url": "https://www.suse.com/security/cve/CVE-2018-17466/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17467 page", "url": "https://www.suse.com/security/cve/CVE-2018-17467/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17468 page", "url": "https://www.suse.com/security/cve/CVE-2018-17468/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17469 page", "url": "https://www.suse.com/security/cve/CVE-2018-17469/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17470 page", "url": "https://www.suse.com/security/cve/CVE-2018-17470/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17471 page", "url": "https://www.suse.com/security/cve/CVE-2018-17471/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17472 page", "url": "https://www.suse.com/security/cve/CVE-2018-17472/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17473 page", "url": "https://www.suse.com/security/cve/CVE-2018-17473/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17474 page", "url": "https://www.suse.com/security/cve/CVE-2018-17474/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17475 page", "url": "https://www.suse.com/security/cve/CVE-2018-17475/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17476 page", "url": "https://www.suse.com/security/cve/CVE-2018-17476/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17477 page", "url": "https://www.suse.com/security/cve/CVE-2018-17477/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17478 page", "url": "https://www.suse.com/security/cve/CVE-2018-17478/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17479 page", "url": "https://www.suse.com/security/cve/CVE-2018-17479/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17480 page", "url": "https://www.suse.com/security/cve/CVE-2018-17480/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-17481 page", "url": "https://www.suse.com/security/cve/CVE-2018-17481/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18335 page", "url": "https://www.suse.com/security/cve/CVE-2018-18335/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18336 page", "url": "https://www.suse.com/security/cve/CVE-2018-18336/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18337 page", "url": "https://www.suse.com/security/cve/CVE-2018-18337/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18338 page", "url": "https://www.suse.com/security/cve/CVE-2018-18338/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18339 page", "url": "https://www.suse.com/security/cve/CVE-2018-18339/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18340 page", "url": "https://www.suse.com/security/cve/CVE-2018-18340/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18341 page", "url": "https://www.suse.com/security/cve/CVE-2018-18341/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18342 page", "url": "https://www.suse.com/security/cve/CVE-2018-18342/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18343 page", "url": "https://www.suse.com/security/cve/CVE-2018-18343/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18344 page", "url": "https://www.suse.com/security/cve/CVE-2018-18344/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18345 page", "url": "https://www.suse.com/security/cve/CVE-2018-18345/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18346 page", "url": "https://www.suse.com/security/cve/CVE-2018-18346/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18347 page", "url": "https://www.suse.com/security/cve/CVE-2018-18347/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18348 page", "url": "https://www.suse.com/security/cve/CVE-2018-18348/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18349 page", "url": "https://www.suse.com/security/cve/CVE-2018-18349/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18350 page", "url": "https://www.suse.com/security/cve/CVE-2018-18350/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18351 page", "url": "https://www.suse.com/security/cve/CVE-2018-18351/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18352 page", "url": "https://www.suse.com/security/cve/CVE-2018-18352/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18353 page", "url": "https://www.suse.com/security/cve/CVE-2018-18353/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18354 page", "url": "https://www.suse.com/security/cve/CVE-2018-18354/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18355 page", "url": "https://www.suse.com/security/cve/CVE-2018-18355/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18356 page", "url": "https://www.suse.com/security/cve/CVE-2018-18356/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18357 page", "url": "https://www.suse.com/security/cve/CVE-2018-18357/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18358 page", "url": "https://www.suse.com/security/cve/CVE-2018-18358/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-18359 page", "url": "https://www.suse.com/security/cve/CVE-2018-18359/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-20073 page", "url": "https://www.suse.com/security/cve/CVE-2018-20073/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-4117 page", "url": "https://www.suse.com/security/cve/CVE-2018-4117/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-5179 page", "url": "https://www.suse.com/security/cve/CVE-2018-5179/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6031 page", "url": "https://www.suse.com/security/cve/CVE-2018-6031/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6032 page", "url": "https://www.suse.com/security/cve/CVE-2018-6032/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6033 page", "url": "https://www.suse.com/security/cve/CVE-2018-6033/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6034 page", "url": "https://www.suse.com/security/cve/CVE-2018-6034/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6035 page", "url": "https://www.suse.com/security/cve/CVE-2018-6035/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6036 page", "url": "https://www.suse.com/security/cve/CVE-2018-6036/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6037 page", "url": "https://www.suse.com/security/cve/CVE-2018-6037/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6038 page", "url": "https://www.suse.com/security/cve/CVE-2018-6038/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6039 page", "url": "https://www.suse.com/security/cve/CVE-2018-6039/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6040 page", "url": "https://www.suse.com/security/cve/CVE-2018-6040/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6041 page", "url": "https://www.suse.com/security/cve/CVE-2018-6041/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6042 page", "url": "https://www.suse.com/security/cve/CVE-2018-6042/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6043 page", "url": "https://www.suse.com/security/cve/CVE-2018-6043/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6044 page", "url": "https://www.suse.com/security/cve/CVE-2018-6044/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6045 page", "url": "https://www.suse.com/security/cve/CVE-2018-6045/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6046 page", "url": "https://www.suse.com/security/cve/CVE-2018-6046/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6047 page", "url": "https://www.suse.com/security/cve/CVE-2018-6047/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6048 page", "url": "https://www.suse.com/security/cve/CVE-2018-6048/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6049 page", "url": "https://www.suse.com/security/cve/CVE-2018-6049/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6050 page", "url": "https://www.suse.com/security/cve/CVE-2018-6050/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6051 page", "url": "https://www.suse.com/security/cve/CVE-2018-6051/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6052 page", "url": "https://www.suse.com/security/cve/CVE-2018-6052/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6053 page", "url": "https://www.suse.com/security/cve/CVE-2018-6053/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6054 page", "url": "https://www.suse.com/security/cve/CVE-2018-6054/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6056 page", "url": "https://www.suse.com/security/cve/CVE-2018-6056/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6057 page", "url": "https://www.suse.com/security/cve/CVE-2018-6057/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6060 page", "url": "https://www.suse.com/security/cve/CVE-2018-6060/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6061 page", "url": "https://www.suse.com/security/cve/CVE-2018-6061/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6062 page", "url": "https://www.suse.com/security/cve/CVE-2018-6062/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6063 page", "url": "https://www.suse.com/security/cve/CVE-2018-6063/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6064 page", "url": "https://www.suse.com/security/cve/CVE-2018-6064/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6065 page", "url": "https://www.suse.com/security/cve/CVE-2018-6065/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6066 page", "url": "https://www.suse.com/security/cve/CVE-2018-6066/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6067 page", "url": "https://www.suse.com/security/cve/CVE-2018-6067/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6068 page", "url": "https://www.suse.com/security/cve/CVE-2018-6068/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6069 page", "url": "https://www.suse.com/security/cve/CVE-2018-6069/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6070 page", "url": "https://www.suse.com/security/cve/CVE-2018-6070/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6071 page", "url": "https://www.suse.com/security/cve/CVE-2018-6071/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6072 page", "url": "https://www.suse.com/security/cve/CVE-2018-6072/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6073 page", "url": "https://www.suse.com/security/cve/CVE-2018-6073/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6074 page", "url": "https://www.suse.com/security/cve/CVE-2018-6074/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6075 page", "url": "https://www.suse.com/security/cve/CVE-2018-6075/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6076 page", "url": "https://www.suse.com/security/cve/CVE-2018-6076/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6077 page", "url": "https://www.suse.com/security/cve/CVE-2018-6077/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6078 page", "url": "https://www.suse.com/security/cve/CVE-2018-6078/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6079 page", "url": "https://www.suse.com/security/cve/CVE-2018-6079/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6080 page", "url": "https://www.suse.com/security/cve/CVE-2018-6080/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6081 page", "url": "https://www.suse.com/security/cve/CVE-2018-6081/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6082 page", "url": "https://www.suse.com/security/cve/CVE-2018-6082/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6083 page", "url": "https://www.suse.com/security/cve/CVE-2018-6083/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6085 page", "url": "https://www.suse.com/security/cve/CVE-2018-6085/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6086 page", "url": "https://www.suse.com/security/cve/CVE-2018-6086/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6087 page", "url": "https://www.suse.com/security/cve/CVE-2018-6087/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6088 page", "url": "https://www.suse.com/security/cve/CVE-2018-6088/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6089 page", "url": "https://www.suse.com/security/cve/CVE-2018-6089/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6090 page", "url": "https://www.suse.com/security/cve/CVE-2018-6090/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6091 page", "url": "https://www.suse.com/security/cve/CVE-2018-6091/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6092 page", "url": "https://www.suse.com/security/cve/CVE-2018-6092/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6093 page", "url": "https://www.suse.com/security/cve/CVE-2018-6093/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6094 page", "url": "https://www.suse.com/security/cve/CVE-2018-6094/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6095 page", "url": "https://www.suse.com/security/cve/CVE-2018-6095/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6096 page", "url": "https://www.suse.com/security/cve/CVE-2018-6096/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6097 page", "url": "https://www.suse.com/security/cve/CVE-2018-6097/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6098 page", "url": "https://www.suse.com/security/cve/CVE-2018-6098/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6099 page", "url": "https://www.suse.com/security/cve/CVE-2018-6099/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6100 page", "url": "https://www.suse.com/security/cve/CVE-2018-6100/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6101 page", "url": "https://www.suse.com/security/cve/CVE-2018-6101/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6102 page", "url": "https://www.suse.com/security/cve/CVE-2018-6102/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6103 page", "url": "https://www.suse.com/security/cve/CVE-2018-6103/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6104 page", "url": "https://www.suse.com/security/cve/CVE-2018-6104/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6105 page", "url": "https://www.suse.com/security/cve/CVE-2018-6105/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6106 page", "url": "https://www.suse.com/security/cve/CVE-2018-6106/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6107 page", "url": "https://www.suse.com/security/cve/CVE-2018-6107/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6108 page", "url": "https://www.suse.com/security/cve/CVE-2018-6108/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6109 page", "url": "https://www.suse.com/security/cve/CVE-2018-6109/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6110 page", "url": "https://www.suse.com/security/cve/CVE-2018-6110/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6111 page", "url": "https://www.suse.com/security/cve/CVE-2018-6111/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6112 page", "url": "https://www.suse.com/security/cve/CVE-2018-6112/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6113 page", "url": "https://www.suse.com/security/cve/CVE-2018-6113/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6114 page", "url": "https://www.suse.com/security/cve/CVE-2018-6114/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6115 page", "url": "https://www.suse.com/security/cve/CVE-2018-6115/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6116 page", "url": "https://www.suse.com/security/cve/CVE-2018-6116/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6117 page", "url": "https://www.suse.com/security/cve/CVE-2018-6117/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6118 page", "url": "https://www.suse.com/security/cve/CVE-2018-6118/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6120 page", "url": "https://www.suse.com/security/cve/CVE-2018-6120/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6121 page", "url": "https://www.suse.com/security/cve/CVE-2018-6121/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6122 page", "url": "https://www.suse.com/security/cve/CVE-2018-6122/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6123 page", "url": "https://www.suse.com/security/cve/CVE-2018-6123/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6124 page", "url": "https://www.suse.com/security/cve/CVE-2018-6124/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6125 page", "url": "https://www.suse.com/security/cve/CVE-2018-6125/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6126 page", "url": "https://www.suse.com/security/cve/CVE-2018-6126/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6127 page", "url": "https://www.suse.com/security/cve/CVE-2018-6127/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6128 page", "url": "https://www.suse.com/security/cve/CVE-2018-6128/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6129 page", "url": "https://www.suse.com/security/cve/CVE-2018-6129/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6130 page", "url": "https://www.suse.com/security/cve/CVE-2018-6130/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6131 page", "url": "https://www.suse.com/security/cve/CVE-2018-6131/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6132 page", "url": "https://www.suse.com/security/cve/CVE-2018-6132/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6133 page", "url": "https://www.suse.com/security/cve/CVE-2018-6133/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6134 page", "url": "https://www.suse.com/security/cve/CVE-2018-6134/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6135 page", "url": "https://www.suse.com/security/cve/CVE-2018-6135/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6136 page", "url": "https://www.suse.com/security/cve/CVE-2018-6136/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6137 page", "url": "https://www.suse.com/security/cve/CVE-2018-6137/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6138 page", "url": "https://www.suse.com/security/cve/CVE-2018-6138/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6139 page", "url": "https://www.suse.com/security/cve/CVE-2018-6139/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6140 page", "url": "https://www.suse.com/security/cve/CVE-2018-6140/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6141 page", "url": "https://www.suse.com/security/cve/CVE-2018-6141/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6142 page", "url": "https://www.suse.com/security/cve/CVE-2018-6142/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6143 page", "url": "https://www.suse.com/security/cve/CVE-2018-6143/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6144 page", "url": "https://www.suse.com/security/cve/CVE-2018-6144/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6145 page", "url": "https://www.suse.com/security/cve/CVE-2018-6145/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6147 page", "url": "https://www.suse.com/security/cve/CVE-2018-6147/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6148 page", "url": "https://www.suse.com/security/cve/CVE-2018-6148/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6149 page", "url": "https://www.suse.com/security/cve/CVE-2018-6149/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6153 page", "url": "https://www.suse.com/security/cve/CVE-2018-6153/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6154 page", "url": "https://www.suse.com/security/cve/CVE-2018-6154/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6155 page", "url": "https://www.suse.com/security/cve/CVE-2018-6155/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6156 page", "url": "https://www.suse.com/security/cve/CVE-2018-6156/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6157 page", "url": "https://www.suse.com/security/cve/CVE-2018-6157/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6158 page", "url": "https://www.suse.com/security/cve/CVE-2018-6158/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6159 page", "url": "https://www.suse.com/security/cve/CVE-2018-6159/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6160 page", "url": "https://www.suse.com/security/cve/CVE-2018-6160/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6161 page", "url": "https://www.suse.com/security/cve/CVE-2018-6161/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6162 page", "url": "https://www.suse.com/security/cve/CVE-2018-6162/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6163 page", "url": "https://www.suse.com/security/cve/CVE-2018-6163/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6164 page", "url": "https://www.suse.com/security/cve/CVE-2018-6164/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6165 page", "url": "https://www.suse.com/security/cve/CVE-2018-6165/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6166 page", "url": "https://www.suse.com/security/cve/CVE-2018-6166/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6167 page", "url": "https://www.suse.com/security/cve/CVE-2018-6167/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6168 page", "url": "https://www.suse.com/security/cve/CVE-2018-6168/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6169 page", "url": "https://www.suse.com/security/cve/CVE-2018-6169/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6170 page", "url": "https://www.suse.com/security/cve/CVE-2018-6170/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6171 page", "url": "https://www.suse.com/security/cve/CVE-2018-6171/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6172 page", "url": "https://www.suse.com/security/cve/CVE-2018-6172/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6173 page", "url": "https://www.suse.com/security/cve/CVE-2018-6173/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6174 page", "url": "https://www.suse.com/security/cve/CVE-2018-6174/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6175 page", "url": "https://www.suse.com/security/cve/CVE-2018-6175/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6176 page", "url": "https://www.suse.com/security/cve/CVE-2018-6176/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6177 page", "url": "https://www.suse.com/security/cve/CVE-2018-6177/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6178 page", "url": "https://www.suse.com/security/cve/CVE-2018-6178/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6179 page", "url": "https://www.suse.com/security/cve/CVE-2018-6179/" }, { "category": "self", "summary": "SUSE CVE CVE-2018-6406 page", "url": "https://www.suse.com/security/cve/CVE-2018-6406/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13659 page", "url": "https://www.suse.com/security/cve/CVE-2019-13659/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13660 page", "url": "https://www.suse.com/security/cve/CVE-2019-13660/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13661 page", "url": "https://www.suse.com/security/cve/CVE-2019-13661/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13662 page", "url": "https://www.suse.com/security/cve/CVE-2019-13662/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13663 page", "url": "https://www.suse.com/security/cve/CVE-2019-13663/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13664 page", "url": "https://www.suse.com/security/cve/CVE-2019-13664/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13665 page", "url": "https://www.suse.com/security/cve/CVE-2019-13665/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13666 page", "url": "https://www.suse.com/security/cve/CVE-2019-13666/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13667 page", "url": "https://www.suse.com/security/cve/CVE-2019-13667/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13668 page", "url": "https://www.suse.com/security/cve/CVE-2019-13668/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13669 page", "url": "https://www.suse.com/security/cve/CVE-2019-13669/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13670 page", "url": "https://www.suse.com/security/cve/CVE-2019-13670/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13671 page", "url": "https://www.suse.com/security/cve/CVE-2019-13671/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13673 page", "url": "https://www.suse.com/security/cve/CVE-2019-13673/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13674 page", "url": "https://www.suse.com/security/cve/CVE-2019-13674/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13675 page", "url": "https://www.suse.com/security/cve/CVE-2019-13675/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13676 page", "url": "https://www.suse.com/security/cve/CVE-2019-13676/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13677 page", "url": "https://www.suse.com/security/cve/CVE-2019-13677/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13678 page", "url": "https://www.suse.com/security/cve/CVE-2019-13678/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13679 page", "url": "https://www.suse.com/security/cve/CVE-2019-13679/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13680 page", "url": "https://www.suse.com/security/cve/CVE-2019-13680/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13681 page", "url": "https://www.suse.com/security/cve/CVE-2019-13681/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13682 page", "url": "https://www.suse.com/security/cve/CVE-2019-13682/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13683 page", "url": "https://www.suse.com/security/cve/CVE-2019-13683/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13685 page", "url": "https://www.suse.com/security/cve/CVE-2019-13685/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13686 page", "url": "https://www.suse.com/security/cve/CVE-2019-13686/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13687 page", "url": "https://www.suse.com/security/cve/CVE-2019-13687/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13688 page", "url": "https://www.suse.com/security/cve/CVE-2019-13688/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13693 page", "url": "https://www.suse.com/security/cve/CVE-2019-13693/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13694 page", "url": "https://www.suse.com/security/cve/CVE-2019-13694/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13695 page", "url": "https://www.suse.com/security/cve/CVE-2019-13695/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13696 page", "url": "https://www.suse.com/security/cve/CVE-2019-13696/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13697 page", "url": "https://www.suse.com/security/cve/CVE-2019-13697/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13699 page", "url": "https://www.suse.com/security/cve/CVE-2019-13699/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13700 page", "url": "https://www.suse.com/security/cve/CVE-2019-13700/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13701 page", "url": "https://www.suse.com/security/cve/CVE-2019-13701/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13702 page", "url": "https://www.suse.com/security/cve/CVE-2019-13702/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13703 page", "url": "https://www.suse.com/security/cve/CVE-2019-13703/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13704 page", "url": "https://www.suse.com/security/cve/CVE-2019-13704/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13705 page", "url": "https://www.suse.com/security/cve/CVE-2019-13705/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13706 page", "url": "https://www.suse.com/security/cve/CVE-2019-13706/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13707 page", "url": "https://www.suse.com/security/cve/CVE-2019-13707/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13708 page", "url": "https://www.suse.com/security/cve/CVE-2019-13708/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13709 page", "url": "https://www.suse.com/security/cve/CVE-2019-13709/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13710 page", "url": "https://www.suse.com/security/cve/CVE-2019-13710/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13711 page", "url": "https://www.suse.com/security/cve/CVE-2019-13711/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13713 page", "url": "https://www.suse.com/security/cve/CVE-2019-13713/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13714 page", "url": "https://www.suse.com/security/cve/CVE-2019-13714/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13715 page", "url": "https://www.suse.com/security/cve/CVE-2019-13715/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13716 page", "url": "https://www.suse.com/security/cve/CVE-2019-13716/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13717 page", "url": "https://www.suse.com/security/cve/CVE-2019-13717/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13718 page", "url": "https://www.suse.com/security/cve/CVE-2019-13718/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13719 page", "url": "https://www.suse.com/security/cve/CVE-2019-13719/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13720 page", "url": "https://www.suse.com/security/cve/CVE-2019-13720/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13721 page", "url": "https://www.suse.com/security/cve/CVE-2019-13721/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13723 page", "url": "https://www.suse.com/security/cve/CVE-2019-13723/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13724 page", "url": "https://www.suse.com/security/cve/CVE-2019-13724/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13725 page", "url": "https://www.suse.com/security/cve/CVE-2019-13725/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13726 page", "url": "https://www.suse.com/security/cve/CVE-2019-13726/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13727 page", "url": "https://www.suse.com/security/cve/CVE-2019-13727/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13728 page", "url": "https://www.suse.com/security/cve/CVE-2019-13728/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13729 page", "url": "https://www.suse.com/security/cve/CVE-2019-13729/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13730 page", "url": "https://www.suse.com/security/cve/CVE-2019-13730/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13732 page", "url": "https://www.suse.com/security/cve/CVE-2019-13732/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13734 page", "url": "https://www.suse.com/security/cve/CVE-2019-13734/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13735 page", "url": "https://www.suse.com/security/cve/CVE-2019-13735/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13736 page", "url": "https://www.suse.com/security/cve/CVE-2019-13736/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13737 page", "url": "https://www.suse.com/security/cve/CVE-2019-13737/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13738 page", "url": "https://www.suse.com/security/cve/CVE-2019-13738/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13739 page", "url": "https://www.suse.com/security/cve/CVE-2019-13739/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13740 page", "url": "https://www.suse.com/security/cve/CVE-2019-13740/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13741 page", "url": "https://www.suse.com/security/cve/CVE-2019-13741/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13742 page", "url": "https://www.suse.com/security/cve/CVE-2019-13742/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13743 page", "url": "https://www.suse.com/security/cve/CVE-2019-13743/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13744 page", "url": "https://www.suse.com/security/cve/CVE-2019-13744/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13745 page", "url": "https://www.suse.com/security/cve/CVE-2019-13745/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13746 page", "url": "https://www.suse.com/security/cve/CVE-2019-13746/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13747 page", "url": "https://www.suse.com/security/cve/CVE-2019-13747/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13748 page", "url": "https://www.suse.com/security/cve/CVE-2019-13748/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13749 page", "url": "https://www.suse.com/security/cve/CVE-2019-13749/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13750 page", "url": "https://www.suse.com/security/cve/CVE-2019-13750/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13751 page", "url": "https://www.suse.com/security/cve/CVE-2019-13751/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13752 page", "url": "https://www.suse.com/security/cve/CVE-2019-13752/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13753 page", "url": "https://www.suse.com/security/cve/CVE-2019-13753/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13754 page", "url": "https://www.suse.com/security/cve/CVE-2019-13754/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13755 page", "url": "https://www.suse.com/security/cve/CVE-2019-13755/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13756 page", "url": "https://www.suse.com/security/cve/CVE-2019-13756/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13757 page", "url": "https://www.suse.com/security/cve/CVE-2019-13757/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13758 page", "url": "https://www.suse.com/security/cve/CVE-2019-13758/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13759 page", "url": "https://www.suse.com/security/cve/CVE-2019-13759/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13761 page", "url": "https://www.suse.com/security/cve/CVE-2019-13761/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13762 page", "url": "https://www.suse.com/security/cve/CVE-2019-13762/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13763 page", "url": "https://www.suse.com/security/cve/CVE-2019-13763/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13764 page", "url": "https://www.suse.com/security/cve/CVE-2019-13764/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-13767 page", "url": "https://www.suse.com/security/cve/CVE-2019-13767/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-15903 page", "url": "https://www.suse.com/security/cve/CVE-2019-15903/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-18197 page", "url": "https://www.suse.com/security/cve/CVE-2019-18197/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19880 page", "url": "https://www.suse.com/security/cve/CVE-2019-19880/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19923 page", "url": "https://www.suse.com/security/cve/CVE-2019-19923/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-19926 page", "url": "https://www.suse.com/security/cve/CVE-2019-19926/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-20503 page", "url": "https://www.suse.com/security/cve/CVE-2019-20503/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5754 page", "url": "https://www.suse.com/security/cve/CVE-2019-5754/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5755 page", "url": "https://www.suse.com/security/cve/CVE-2019-5755/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5756 page", "url": "https://www.suse.com/security/cve/CVE-2019-5756/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5757 page", "url": "https://www.suse.com/security/cve/CVE-2019-5757/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5758 page", "url": "https://www.suse.com/security/cve/CVE-2019-5758/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5759 page", "url": "https://www.suse.com/security/cve/CVE-2019-5759/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5760 page", "url": "https://www.suse.com/security/cve/CVE-2019-5760/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5761 page", "url": "https://www.suse.com/security/cve/CVE-2019-5761/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5762 page", "url": "https://www.suse.com/security/cve/CVE-2019-5762/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5763 page", "url": "https://www.suse.com/security/cve/CVE-2019-5763/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5764 page", "url": "https://www.suse.com/security/cve/CVE-2019-5764/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5765 page", "url": "https://www.suse.com/security/cve/CVE-2019-5765/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5766 page", "url": "https://www.suse.com/security/cve/CVE-2019-5766/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5767 page", "url": "https://www.suse.com/security/cve/CVE-2019-5767/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5768 page", "url": "https://www.suse.com/security/cve/CVE-2019-5768/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5769 page", "url": "https://www.suse.com/security/cve/CVE-2019-5769/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5770 page", "url": "https://www.suse.com/security/cve/CVE-2019-5770/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5771 page", "url": "https://www.suse.com/security/cve/CVE-2019-5771/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5772 page", "url": "https://www.suse.com/security/cve/CVE-2019-5772/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5773 page", "url": "https://www.suse.com/security/cve/CVE-2019-5773/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5774 page", "url": "https://www.suse.com/security/cve/CVE-2019-5774/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5775 page", "url": "https://www.suse.com/security/cve/CVE-2019-5775/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5776 page", "url": "https://www.suse.com/security/cve/CVE-2019-5776/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5777 page", "url": "https://www.suse.com/security/cve/CVE-2019-5777/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5778 page", "url": "https://www.suse.com/security/cve/CVE-2019-5778/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5779 page", "url": "https://www.suse.com/security/cve/CVE-2019-5779/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5780 page", "url": "https://www.suse.com/security/cve/CVE-2019-5780/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5781 page", "url": "https://www.suse.com/security/cve/CVE-2019-5781/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5782 page", "url": "https://www.suse.com/security/cve/CVE-2019-5782/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5784 page", "url": "https://www.suse.com/security/cve/CVE-2019-5784/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5786 page", "url": "https://www.suse.com/security/cve/CVE-2019-5786/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5787 page", "url": "https://www.suse.com/security/cve/CVE-2019-5787/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5788 page", "url": "https://www.suse.com/security/cve/CVE-2019-5788/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5789 page", "url": "https://www.suse.com/security/cve/CVE-2019-5789/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5790 page", "url": "https://www.suse.com/security/cve/CVE-2019-5790/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5791 page", "url": "https://www.suse.com/security/cve/CVE-2019-5791/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5792 page", "url": "https://www.suse.com/security/cve/CVE-2019-5792/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5793 page", "url": "https://www.suse.com/security/cve/CVE-2019-5793/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5794 page", "url": "https://www.suse.com/security/cve/CVE-2019-5794/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5795 page", "url": "https://www.suse.com/security/cve/CVE-2019-5795/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5796 page", "url": "https://www.suse.com/security/cve/CVE-2019-5796/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5797 page", "url": "https://www.suse.com/security/cve/CVE-2019-5797/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5798 page", "url": "https://www.suse.com/security/cve/CVE-2019-5798/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5799 page", "url": "https://www.suse.com/security/cve/CVE-2019-5799/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5800 page", "url": "https://www.suse.com/security/cve/CVE-2019-5800/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5801 page", "url": "https://www.suse.com/security/cve/CVE-2019-5801/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5802 page", "url": "https://www.suse.com/security/cve/CVE-2019-5802/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5803 page", "url": "https://www.suse.com/security/cve/CVE-2019-5803/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5804 page", "url": "https://www.suse.com/security/cve/CVE-2019-5804/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5805 page", "url": "https://www.suse.com/security/cve/CVE-2019-5805/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5806 page", "url": "https://www.suse.com/security/cve/CVE-2019-5806/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5807 page", "url": "https://www.suse.com/security/cve/CVE-2019-5807/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5808 page", "url": "https://www.suse.com/security/cve/CVE-2019-5808/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5809 page", "url": "https://www.suse.com/security/cve/CVE-2019-5809/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5810 page", "url": "https://www.suse.com/security/cve/CVE-2019-5810/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5811 page", "url": "https://www.suse.com/security/cve/CVE-2019-5811/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5812 page", "url": "https://www.suse.com/security/cve/CVE-2019-5812/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5813 page", "url": "https://www.suse.com/security/cve/CVE-2019-5813/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5814 page", "url": "https://www.suse.com/security/cve/CVE-2019-5814/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5815 page", "url": "https://www.suse.com/security/cve/CVE-2019-5815/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5816 page", "url": "https://www.suse.com/security/cve/CVE-2019-5816/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5817 page", "url": "https://www.suse.com/security/cve/CVE-2019-5817/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5818 page", "url": "https://www.suse.com/security/cve/CVE-2019-5818/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5819 page", "url": "https://www.suse.com/security/cve/CVE-2019-5819/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5820 page", "url": "https://www.suse.com/security/cve/CVE-2019-5820/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5821 page", "url": "https://www.suse.com/security/cve/CVE-2019-5821/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5822 page", "url": "https://www.suse.com/security/cve/CVE-2019-5822/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5823 page", "url": "https://www.suse.com/security/cve/CVE-2019-5823/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5824 page", "url": "https://www.suse.com/security/cve/CVE-2019-5824/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5827 page", "url": "https://www.suse.com/security/cve/CVE-2019-5827/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5828 page", "url": "https://www.suse.com/security/cve/CVE-2019-5828/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5829 page", "url": "https://www.suse.com/security/cve/CVE-2019-5829/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5830 page", "url": "https://www.suse.com/security/cve/CVE-2019-5830/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5831 page", "url": "https://www.suse.com/security/cve/CVE-2019-5831/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5832 page", "url": "https://www.suse.com/security/cve/CVE-2019-5832/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5833 page", "url": "https://www.suse.com/security/cve/CVE-2019-5833/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5834 page", "url": "https://www.suse.com/security/cve/CVE-2019-5834/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5835 page", "url": "https://www.suse.com/security/cve/CVE-2019-5835/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5836 page", "url": "https://www.suse.com/security/cve/CVE-2019-5836/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5837 page", "url": "https://www.suse.com/security/cve/CVE-2019-5837/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5838 page", "url": "https://www.suse.com/security/cve/CVE-2019-5838/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5839 page", "url": "https://www.suse.com/security/cve/CVE-2019-5839/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5840 page", "url": "https://www.suse.com/security/cve/CVE-2019-5840/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5842 page", "url": "https://www.suse.com/security/cve/CVE-2019-5842/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5844 page", "url": "https://www.suse.com/security/cve/CVE-2019-5844/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5847 page", "url": "https://www.suse.com/security/cve/CVE-2019-5847/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5848 page", "url": "https://www.suse.com/security/cve/CVE-2019-5848/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5850 page", "url": "https://www.suse.com/security/cve/CVE-2019-5850/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5851 page", "url": "https://www.suse.com/security/cve/CVE-2019-5851/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5852 page", "url": "https://www.suse.com/security/cve/CVE-2019-5852/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5853 page", "url": "https://www.suse.com/security/cve/CVE-2019-5853/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5854 page", "url": "https://www.suse.com/security/cve/CVE-2019-5854/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5855 page", "url": "https://www.suse.com/security/cve/CVE-2019-5855/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5856 page", "url": "https://www.suse.com/security/cve/CVE-2019-5856/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5857 page", "url": "https://www.suse.com/security/cve/CVE-2019-5857/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5858 page", "url": "https://www.suse.com/security/cve/CVE-2019-5858/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5859 page", "url": "https://www.suse.com/security/cve/CVE-2019-5859/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5860 page", "url": "https://www.suse.com/security/cve/CVE-2019-5860/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5861 page", "url": "https://www.suse.com/security/cve/CVE-2019-5861/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5862 page", "url": "https://www.suse.com/security/cve/CVE-2019-5862/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5863 page", "url": "https://www.suse.com/security/cve/CVE-2019-5863/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5864 page", "url": "https://www.suse.com/security/cve/CVE-2019-5864/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5865 page", "url": "https://www.suse.com/security/cve/CVE-2019-5865/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5867 page", "url": "https://www.suse.com/security/cve/CVE-2019-5867/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5868 page", "url": "https://www.suse.com/security/cve/CVE-2019-5868/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5869 page", "url": "https://www.suse.com/security/cve/CVE-2019-5869/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5870 page", "url": "https://www.suse.com/security/cve/CVE-2019-5870/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5871 page", "url": "https://www.suse.com/security/cve/CVE-2019-5871/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5872 page", "url": "https://www.suse.com/security/cve/CVE-2019-5872/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5874 page", "url": "https://www.suse.com/security/cve/CVE-2019-5874/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5875 page", "url": "https://www.suse.com/security/cve/CVE-2019-5875/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5876 page", "url": "https://www.suse.com/security/cve/CVE-2019-5876/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5877 page", "url": "https://www.suse.com/security/cve/CVE-2019-5877/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5878 page", "url": "https://www.suse.com/security/cve/CVE-2019-5878/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5879 page", "url": "https://www.suse.com/security/cve/CVE-2019-5879/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5880 page", "url": "https://www.suse.com/security/cve/CVE-2019-5880/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-5881 page", "url": "https://www.suse.com/security/cve/CVE-2019-5881/" }, { "category": "self", "summary": "SUSE CVE CVE-2019-8075 page", "url": "https://www.suse.com/security/cve/CVE-2019-8075/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-0561 page", "url": "https://www.suse.com/security/cve/CVE-2020-0561/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15959 page", "url": "https://www.suse.com/security/cve/CVE-2020-15959/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15960 page", "url": "https://www.suse.com/security/cve/CVE-2020-15960/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15961 page", "url": "https://www.suse.com/security/cve/CVE-2020-15961/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15962 page", "url": "https://www.suse.com/security/cve/CVE-2020-15962/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15963 page", "url": "https://www.suse.com/security/cve/CVE-2020-15963/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15964 page", "url": "https://www.suse.com/security/cve/CVE-2020-15964/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15965 page", "url": "https://www.suse.com/security/cve/CVE-2020-15965/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15966 page", "url": "https://www.suse.com/security/cve/CVE-2020-15966/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15967 page", "url": "https://www.suse.com/security/cve/CVE-2020-15967/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15968 page", "url": "https://www.suse.com/security/cve/CVE-2020-15968/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15969 page", "url": "https://www.suse.com/security/cve/CVE-2020-15969/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15970 page", "url": "https://www.suse.com/security/cve/CVE-2020-15970/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15971 page", "url": "https://www.suse.com/security/cve/CVE-2020-15971/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15972 page", "url": "https://www.suse.com/security/cve/CVE-2020-15972/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15973 page", "url": "https://www.suse.com/security/cve/CVE-2020-15973/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15974 page", "url": "https://www.suse.com/security/cve/CVE-2020-15974/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15975 page", "url": "https://www.suse.com/security/cve/CVE-2020-15975/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15976 page", "url": "https://www.suse.com/security/cve/CVE-2020-15976/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15977 page", "url": "https://www.suse.com/security/cve/CVE-2020-15977/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15978 page", "url": "https://www.suse.com/security/cve/CVE-2020-15978/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15979 page", "url": "https://www.suse.com/security/cve/CVE-2020-15979/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15980 page", "url": "https://www.suse.com/security/cve/CVE-2020-15980/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15981 page", "url": "https://www.suse.com/security/cve/CVE-2020-15981/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15982 page", "url": "https://www.suse.com/security/cve/CVE-2020-15982/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15983 page", "url": "https://www.suse.com/security/cve/CVE-2020-15983/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15984 page", "url": "https://www.suse.com/security/cve/CVE-2020-15984/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15985 page", "url": "https://www.suse.com/security/cve/CVE-2020-15985/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15986 page", "url": "https://www.suse.com/security/cve/CVE-2020-15986/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15987 page", "url": "https://www.suse.com/security/cve/CVE-2020-15987/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15988 page", "url": "https://www.suse.com/security/cve/CVE-2020-15988/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15989 page", "url": "https://www.suse.com/security/cve/CVE-2020-15989/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15990 page", "url": "https://www.suse.com/security/cve/CVE-2020-15990/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15991 page", "url": "https://www.suse.com/security/cve/CVE-2020-15991/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15992 page", "url": "https://www.suse.com/security/cve/CVE-2020-15992/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15995 page", "url": "https://www.suse.com/security/cve/CVE-2020-15995/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-15999 page", "url": "https://www.suse.com/security/cve/CVE-2020-15999/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16000 page", "url": "https://www.suse.com/security/cve/CVE-2020-16000/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16001 page", "url": "https://www.suse.com/security/cve/CVE-2020-16001/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16002 page", "url": "https://www.suse.com/security/cve/CVE-2020-16002/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16003 page", "url": "https://www.suse.com/security/cve/CVE-2020-16003/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16004 page", "url": "https://www.suse.com/security/cve/CVE-2020-16004/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16005 page", "url": "https://www.suse.com/security/cve/CVE-2020-16005/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16006 page", "url": "https://www.suse.com/security/cve/CVE-2020-16006/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16007 page", "url": "https://www.suse.com/security/cve/CVE-2020-16007/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16008 page", "url": "https://www.suse.com/security/cve/CVE-2020-16008/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16009 page", "url": "https://www.suse.com/security/cve/CVE-2020-16009/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16011 page", "url": "https://www.suse.com/security/cve/CVE-2020-16011/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16012 page", "url": "https://www.suse.com/security/cve/CVE-2020-16012/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16013 page", "url": "https://www.suse.com/security/cve/CVE-2020-16013/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16014 page", "url": "https://www.suse.com/security/cve/CVE-2020-16014/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16015 page", "url": "https://www.suse.com/security/cve/CVE-2020-16015/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16016 page", "url": "https://www.suse.com/security/cve/CVE-2020-16016/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16017 page", "url": "https://www.suse.com/security/cve/CVE-2020-16017/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16018 page", "url": "https://www.suse.com/security/cve/CVE-2020-16018/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16019 page", "url": "https://www.suse.com/security/cve/CVE-2020-16019/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16020 page", "url": "https://www.suse.com/security/cve/CVE-2020-16020/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16021 page", "url": "https://www.suse.com/security/cve/CVE-2020-16021/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16022 page", "url": "https://www.suse.com/security/cve/CVE-2020-16022/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16023 page", "url": "https://www.suse.com/security/cve/CVE-2020-16023/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16024 page", "url": "https://www.suse.com/security/cve/CVE-2020-16024/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16025 page", "url": "https://www.suse.com/security/cve/CVE-2020-16025/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16026 page", "url": "https://www.suse.com/security/cve/CVE-2020-16026/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16027 page", "url": "https://www.suse.com/security/cve/CVE-2020-16027/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16028 page", "url": "https://www.suse.com/security/cve/CVE-2020-16028/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16029 page", "url": "https://www.suse.com/security/cve/CVE-2020-16029/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16030 page", "url": "https://www.suse.com/security/cve/CVE-2020-16030/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16031 page", "url": "https://www.suse.com/security/cve/CVE-2020-16031/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16032 page", "url": "https://www.suse.com/security/cve/CVE-2020-16032/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16033 page", "url": "https://www.suse.com/security/cve/CVE-2020-16033/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16034 page", "url": "https://www.suse.com/security/cve/CVE-2020-16034/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16035 page", "url": "https://www.suse.com/security/cve/CVE-2020-16035/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16036 page", "url": "https://www.suse.com/security/cve/CVE-2020-16036/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16037 page", "url": "https://www.suse.com/security/cve/CVE-2020-16037/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16038 page", "url": "https://www.suse.com/security/cve/CVE-2020-16038/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16039 page", "url": "https://www.suse.com/security/cve/CVE-2020-16039/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16040 page", "url": "https://www.suse.com/security/cve/CVE-2020-16040/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16041 page", "url": "https://www.suse.com/security/cve/CVE-2020-16041/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16042 page", "url": "https://www.suse.com/security/cve/CVE-2020-16042/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16043 page", "url": "https://www.suse.com/security/cve/CVE-2020-16043/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-16044 page", "url": "https://www.suse.com/security/cve/CVE-2020-16044/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-27844 page", "url": "https://www.suse.com/security/cve/CVE-2020-27844/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6377 page", "url": "https://www.suse.com/security/cve/CVE-2020-6377/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6378 page", "url": "https://www.suse.com/security/cve/CVE-2020-6378/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6379 page", "url": "https://www.suse.com/security/cve/CVE-2020-6379/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6380 page", "url": "https://www.suse.com/security/cve/CVE-2020-6380/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6381 page", "url": "https://www.suse.com/security/cve/CVE-2020-6381/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6382 page", "url": "https://www.suse.com/security/cve/CVE-2020-6382/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6385 page", "url": "https://www.suse.com/security/cve/CVE-2020-6385/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6387 page", "url": "https://www.suse.com/security/cve/CVE-2020-6387/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6388 page", "url": "https://www.suse.com/security/cve/CVE-2020-6388/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6389 page", "url": "https://www.suse.com/security/cve/CVE-2020-6389/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6390 page", "url": "https://www.suse.com/security/cve/CVE-2020-6390/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6391 page", "url": "https://www.suse.com/security/cve/CVE-2020-6391/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6392 page", "url": "https://www.suse.com/security/cve/CVE-2020-6392/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6393 page", "url": "https://www.suse.com/security/cve/CVE-2020-6393/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6394 page", "url": "https://www.suse.com/security/cve/CVE-2020-6394/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6395 page", "url": "https://www.suse.com/security/cve/CVE-2020-6395/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6396 page", "url": "https://www.suse.com/security/cve/CVE-2020-6396/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6397 page", "url": "https://www.suse.com/security/cve/CVE-2020-6397/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6398 page", "url": "https://www.suse.com/security/cve/CVE-2020-6398/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6399 page", "url": "https://www.suse.com/security/cve/CVE-2020-6399/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6400 page", "url": "https://www.suse.com/security/cve/CVE-2020-6400/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6401 page", "url": "https://www.suse.com/security/cve/CVE-2020-6401/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6402 page", "url": "https://www.suse.com/security/cve/CVE-2020-6402/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6403 page", "url": "https://www.suse.com/security/cve/CVE-2020-6403/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6404 page", "url": "https://www.suse.com/security/cve/CVE-2020-6404/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6405 page", "url": "https://www.suse.com/security/cve/CVE-2020-6405/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6406 page", "url": "https://www.suse.com/security/cve/CVE-2020-6406/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6407 page", "url": "https://www.suse.com/security/cve/CVE-2020-6407/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6408 page", "url": "https://www.suse.com/security/cve/CVE-2020-6408/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6409 page", "url": "https://www.suse.com/security/cve/CVE-2020-6409/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6410 page", "url": "https://www.suse.com/security/cve/CVE-2020-6410/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6411 page", "url": "https://www.suse.com/security/cve/CVE-2020-6411/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6412 page", "url": "https://www.suse.com/security/cve/CVE-2020-6412/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6413 page", "url": "https://www.suse.com/security/cve/CVE-2020-6413/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6414 page", "url": "https://www.suse.com/security/cve/CVE-2020-6414/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6415 page", "url": "https://www.suse.com/security/cve/CVE-2020-6415/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6416 page", "url": "https://www.suse.com/security/cve/CVE-2020-6416/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6417 page", "url": "https://www.suse.com/security/cve/CVE-2020-6417/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6418 page", "url": "https://www.suse.com/security/cve/CVE-2020-6418/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6420 page", "url": "https://www.suse.com/security/cve/CVE-2020-6420/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6422 page", "url": "https://www.suse.com/security/cve/CVE-2020-6422/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6423 page", "url": "https://www.suse.com/security/cve/CVE-2020-6423/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6424 page", "url": "https://www.suse.com/security/cve/CVE-2020-6424/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6425 page", "url": "https://www.suse.com/security/cve/CVE-2020-6425/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6426 page", "url": "https://www.suse.com/security/cve/CVE-2020-6426/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6427 page", "url": "https://www.suse.com/security/cve/CVE-2020-6427/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6428 page", "url": "https://www.suse.com/security/cve/CVE-2020-6428/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6429 page", "url": "https://www.suse.com/security/cve/CVE-2020-6429/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6430 page", "url": "https://www.suse.com/security/cve/CVE-2020-6430/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6431 page", "url": "https://www.suse.com/security/cve/CVE-2020-6431/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6432 page", "url": "https://www.suse.com/security/cve/CVE-2020-6432/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6433 page", "url": "https://www.suse.com/security/cve/CVE-2020-6433/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6434 page", "url": "https://www.suse.com/security/cve/CVE-2020-6434/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6435 page", "url": "https://www.suse.com/security/cve/CVE-2020-6435/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6436 page", "url": "https://www.suse.com/security/cve/CVE-2020-6436/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6437 page", "url": "https://www.suse.com/security/cve/CVE-2020-6437/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6438 page", "url": "https://www.suse.com/security/cve/CVE-2020-6438/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6439 page", "url": "https://www.suse.com/security/cve/CVE-2020-6439/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6440 page", "url": "https://www.suse.com/security/cve/CVE-2020-6440/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6441 page", "url": "https://www.suse.com/security/cve/CVE-2020-6441/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6442 page", "url": "https://www.suse.com/security/cve/CVE-2020-6442/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6443 page", "url": "https://www.suse.com/security/cve/CVE-2020-6443/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6444 page", "url": "https://www.suse.com/security/cve/CVE-2020-6444/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6445 page", "url": "https://www.suse.com/security/cve/CVE-2020-6445/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6446 page", "url": "https://www.suse.com/security/cve/CVE-2020-6446/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6447 page", "url": "https://www.suse.com/security/cve/CVE-2020-6447/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6448 page", "url": "https://www.suse.com/security/cve/CVE-2020-6448/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6449 page", "url": "https://www.suse.com/security/cve/CVE-2020-6449/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6450 page", "url": "https://www.suse.com/security/cve/CVE-2020-6450/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6451 page", "url": "https://www.suse.com/security/cve/CVE-2020-6451/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6452 page", "url": "https://www.suse.com/security/cve/CVE-2020-6452/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6454 page", "url": "https://www.suse.com/security/cve/CVE-2020-6454/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6455 page", "url": "https://www.suse.com/security/cve/CVE-2020-6455/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6456 page", "url": "https://www.suse.com/security/cve/CVE-2020-6456/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6457 page", "url": "https://www.suse.com/security/cve/CVE-2020-6457/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6458 page", "url": "https://www.suse.com/security/cve/CVE-2020-6458/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6459 page", "url": "https://www.suse.com/security/cve/CVE-2020-6459/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6460 page", "url": "https://www.suse.com/security/cve/CVE-2020-6460/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6462 page", "url": "https://www.suse.com/security/cve/CVE-2020-6462/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6463 page", "url": "https://www.suse.com/security/cve/CVE-2020-6463/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6464 page", "url": "https://www.suse.com/security/cve/CVE-2020-6464/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6465 page", "url": "https://www.suse.com/security/cve/CVE-2020-6465/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6466 page", "url": "https://www.suse.com/security/cve/CVE-2020-6466/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6467 page", "url": "https://www.suse.com/security/cve/CVE-2020-6467/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6468 page", "url": "https://www.suse.com/security/cve/CVE-2020-6468/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6469 page", "url": "https://www.suse.com/security/cve/CVE-2020-6469/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6470 page", "url": "https://www.suse.com/security/cve/CVE-2020-6470/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6471 page", "url": "https://www.suse.com/security/cve/CVE-2020-6471/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6472 page", "url": "https://www.suse.com/security/cve/CVE-2020-6472/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6473 page", "url": "https://www.suse.com/security/cve/CVE-2020-6473/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6474 page", "url": "https://www.suse.com/security/cve/CVE-2020-6474/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6475 page", "url": "https://www.suse.com/security/cve/CVE-2020-6475/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6476 page", "url": "https://www.suse.com/security/cve/CVE-2020-6476/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6477 page", "url": "https://www.suse.com/security/cve/CVE-2020-6477/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6478 page", "url": "https://www.suse.com/security/cve/CVE-2020-6478/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6479 page", "url": "https://www.suse.com/security/cve/CVE-2020-6479/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6480 page", "url": "https://www.suse.com/security/cve/CVE-2020-6480/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6481 page", "url": "https://www.suse.com/security/cve/CVE-2020-6481/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6482 page", "url": "https://www.suse.com/security/cve/CVE-2020-6482/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6483 page", "url": "https://www.suse.com/security/cve/CVE-2020-6483/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6484 page", "url": "https://www.suse.com/security/cve/CVE-2020-6484/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6485 page", "url": "https://www.suse.com/security/cve/CVE-2020-6485/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6486 page", "url": "https://www.suse.com/security/cve/CVE-2020-6486/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6487 page", "url": "https://www.suse.com/security/cve/CVE-2020-6487/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6488 page", "url": "https://www.suse.com/security/cve/CVE-2020-6488/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6489 page", "url": "https://www.suse.com/security/cve/CVE-2020-6489/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6490 page", "url": "https://www.suse.com/security/cve/CVE-2020-6490/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6491 page", "url": "https://www.suse.com/security/cve/CVE-2020-6491/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6493 page", "url": "https://www.suse.com/security/cve/CVE-2020-6493/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6494 page", "url": "https://www.suse.com/security/cve/CVE-2020-6494/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6495 page", "url": "https://www.suse.com/security/cve/CVE-2020-6495/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6496 page", "url": "https://www.suse.com/security/cve/CVE-2020-6496/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6505 page", "url": "https://www.suse.com/security/cve/CVE-2020-6505/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6506 page", "url": "https://www.suse.com/security/cve/CVE-2020-6506/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6507 page", "url": "https://www.suse.com/security/cve/CVE-2020-6507/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6509 page", "url": "https://www.suse.com/security/cve/CVE-2020-6509/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6510 page", "url": "https://www.suse.com/security/cve/CVE-2020-6510/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6511 page", "url": "https://www.suse.com/security/cve/CVE-2020-6511/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6512 page", "url": "https://www.suse.com/security/cve/CVE-2020-6512/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6513 page", "url": "https://www.suse.com/security/cve/CVE-2020-6513/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6514 page", "url": "https://www.suse.com/security/cve/CVE-2020-6514/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6515 page", "url": "https://www.suse.com/security/cve/CVE-2020-6515/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6516 page", "url": "https://www.suse.com/security/cve/CVE-2020-6516/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6517 page", "url": "https://www.suse.com/security/cve/CVE-2020-6517/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6518 page", "url": "https://www.suse.com/security/cve/CVE-2020-6518/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6519 page", "url": "https://www.suse.com/security/cve/CVE-2020-6519/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6520 page", "url": "https://www.suse.com/security/cve/CVE-2020-6520/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6521 page", "url": "https://www.suse.com/security/cve/CVE-2020-6521/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6522 page", "url": "https://www.suse.com/security/cve/CVE-2020-6522/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6523 page", "url": "https://www.suse.com/security/cve/CVE-2020-6523/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6524 page", "url": "https://www.suse.com/security/cve/CVE-2020-6524/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6525 page", "url": "https://www.suse.com/security/cve/CVE-2020-6525/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6526 page", "url": "https://www.suse.com/security/cve/CVE-2020-6526/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6527 page", "url": "https://www.suse.com/security/cve/CVE-2020-6527/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6528 page", "url": "https://www.suse.com/security/cve/CVE-2020-6528/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6529 page", "url": "https://www.suse.com/security/cve/CVE-2020-6529/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6530 page", "url": "https://www.suse.com/security/cve/CVE-2020-6530/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6531 page", "url": "https://www.suse.com/security/cve/CVE-2020-6531/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6532 page", "url": "https://www.suse.com/security/cve/CVE-2020-6532/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6533 page", "url": "https://www.suse.com/security/cve/CVE-2020-6533/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6534 page", "url": "https://www.suse.com/security/cve/CVE-2020-6534/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6535 page", "url": "https://www.suse.com/security/cve/CVE-2020-6535/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6536 page", "url": "https://www.suse.com/security/cve/CVE-2020-6536/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6537 page", "url": "https://www.suse.com/security/cve/CVE-2020-6537/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6538 page", "url": "https://www.suse.com/security/cve/CVE-2020-6538/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6539 page", "url": "https://www.suse.com/security/cve/CVE-2020-6539/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6540 page", "url": "https://www.suse.com/security/cve/CVE-2020-6540/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6541 page", "url": "https://www.suse.com/security/cve/CVE-2020-6541/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6542 page", "url": "https://www.suse.com/security/cve/CVE-2020-6542/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6543 page", "url": "https://www.suse.com/security/cve/CVE-2020-6543/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6544 page", "url": "https://www.suse.com/security/cve/CVE-2020-6544/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6545 page", "url": "https://www.suse.com/security/cve/CVE-2020-6545/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6546 page", "url": "https://www.suse.com/security/cve/CVE-2020-6546/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6547 page", "url": "https://www.suse.com/security/cve/CVE-2020-6547/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6548 page", "url": "https://www.suse.com/security/cve/CVE-2020-6548/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6549 page", "url": "https://www.suse.com/security/cve/CVE-2020-6549/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6550 page", "url": "https://www.suse.com/security/cve/CVE-2020-6550/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6551 page", "url": "https://www.suse.com/security/cve/CVE-2020-6551/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6552 page", "url": "https://www.suse.com/security/cve/CVE-2020-6552/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6553 page", "url": "https://www.suse.com/security/cve/CVE-2020-6553/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6554 page", "url": "https://www.suse.com/security/cve/CVE-2020-6554/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6555 page", "url": "https://www.suse.com/security/cve/CVE-2020-6555/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6556 page", "url": "https://www.suse.com/security/cve/CVE-2020-6556/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6557 page", "url": "https://www.suse.com/security/cve/CVE-2020-6557/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6558 page", "url": "https://www.suse.com/security/cve/CVE-2020-6558/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6559 page", "url": "https://www.suse.com/security/cve/CVE-2020-6559/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6560 page", "url": "https://www.suse.com/security/cve/CVE-2020-6560/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6561 page", "url": "https://www.suse.com/security/cve/CVE-2020-6561/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6562 page", "url": "https://www.suse.com/security/cve/CVE-2020-6562/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6563 page", "url": "https://www.suse.com/security/cve/CVE-2020-6563/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6564 page", "url": "https://www.suse.com/security/cve/CVE-2020-6564/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6565 page", "url": "https://www.suse.com/security/cve/CVE-2020-6565/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6566 page", "url": "https://www.suse.com/security/cve/CVE-2020-6566/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6567 page", "url": "https://www.suse.com/security/cve/CVE-2020-6567/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6568 page", "url": "https://www.suse.com/security/cve/CVE-2020-6568/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6569 page", "url": "https://www.suse.com/security/cve/CVE-2020-6569/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6570 page", "url": "https://www.suse.com/security/cve/CVE-2020-6570/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6571 page", "url": "https://www.suse.com/security/cve/CVE-2020-6571/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6573 page", "url": "https://www.suse.com/security/cve/CVE-2020-6573/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6574 page", "url": "https://www.suse.com/security/cve/CVE-2020-6574/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6575 page", "url": "https://www.suse.com/security/cve/CVE-2020-6575/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6576 page", "url": "https://www.suse.com/security/cve/CVE-2020-6576/" }, { "category": "self", "summary": "SUSE CVE CVE-2020-6831 page", "url": "https://www.suse.com/security/cve/CVE-2020-6831/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21106 page", "url": "https://www.suse.com/security/cve/CVE-2021-21106/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21107 page", "url": "https://www.suse.com/security/cve/CVE-2021-21107/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21108 page", "url": "https://www.suse.com/security/cve/CVE-2021-21108/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21109 page", "url": "https://www.suse.com/security/cve/CVE-2021-21109/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21110 page", "url": "https://www.suse.com/security/cve/CVE-2021-21110/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21111 page", "url": "https://www.suse.com/security/cve/CVE-2021-21111/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21112 page", "url": "https://www.suse.com/security/cve/CVE-2021-21112/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21113 page", "url": "https://www.suse.com/security/cve/CVE-2021-21113/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21114 page", "url": "https://www.suse.com/security/cve/CVE-2021-21114/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21115 page", "url": "https://www.suse.com/security/cve/CVE-2021-21115/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21116 page", "url": "https://www.suse.com/security/cve/CVE-2021-21116/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21117 page", "url": "https://www.suse.com/security/cve/CVE-2021-21117/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21118 page", "url": "https://www.suse.com/security/cve/CVE-2021-21118/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21119 page", "url": "https://www.suse.com/security/cve/CVE-2021-21119/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21120 page", "url": "https://www.suse.com/security/cve/CVE-2021-21120/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21121 page", "url": "https://www.suse.com/security/cve/CVE-2021-21121/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21122 page", "url": "https://www.suse.com/security/cve/CVE-2021-21122/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21123 page", "url": "https://www.suse.com/security/cve/CVE-2021-21123/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21124 page", "url": "https://www.suse.com/security/cve/CVE-2021-21124/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21125 page", "url": "https://www.suse.com/security/cve/CVE-2021-21125/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21126 page", "url": "https://www.suse.com/security/cve/CVE-2021-21126/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21127 page", "url": "https://www.suse.com/security/cve/CVE-2021-21127/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21128 page", "url": "https://www.suse.com/security/cve/CVE-2021-21128/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21129 page", "url": "https://www.suse.com/security/cve/CVE-2021-21129/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21130 page", "url": "https://www.suse.com/security/cve/CVE-2021-21130/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21131 page", "url": "https://www.suse.com/security/cve/CVE-2021-21131/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21132 page", "url": "https://www.suse.com/security/cve/CVE-2021-21132/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21133 page", "url": "https://www.suse.com/security/cve/CVE-2021-21133/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21134 page", "url": "https://www.suse.com/security/cve/CVE-2021-21134/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21135 page", "url": "https://www.suse.com/security/cve/CVE-2021-21135/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21136 page", "url": "https://www.suse.com/security/cve/CVE-2021-21136/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21137 page", "url": "https://www.suse.com/security/cve/CVE-2021-21137/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21138 page", "url": "https://www.suse.com/security/cve/CVE-2021-21138/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21139 page", "url": "https://www.suse.com/security/cve/CVE-2021-21139/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21140 page", "url": "https://www.suse.com/security/cve/CVE-2021-21140/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21141 page", "url": "https://www.suse.com/security/cve/CVE-2021-21141/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21142 page", "url": "https://www.suse.com/security/cve/CVE-2021-21142/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21143 page", "url": "https://www.suse.com/security/cve/CVE-2021-21143/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21144 page", "url": "https://www.suse.com/security/cve/CVE-2021-21144/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21145 page", "url": "https://www.suse.com/security/cve/CVE-2021-21145/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21146 page", "url": "https://www.suse.com/security/cve/CVE-2021-21146/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21147 page", "url": "https://www.suse.com/security/cve/CVE-2021-21147/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21148 page", "url": "https://www.suse.com/security/cve/CVE-2021-21148/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21149 page", "url": "https://www.suse.com/security/cve/CVE-2021-21149/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21150 page", "url": "https://www.suse.com/security/cve/CVE-2021-21150/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21151 page", "url": "https://www.suse.com/security/cve/CVE-2021-21151/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21152 page", "url": "https://www.suse.com/security/cve/CVE-2021-21152/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21153 page", "url": "https://www.suse.com/security/cve/CVE-2021-21153/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21154 page", "url": "https://www.suse.com/security/cve/CVE-2021-21154/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21155 page", "url": "https://www.suse.com/security/cve/CVE-2021-21155/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21156 page", "url": "https://www.suse.com/security/cve/CVE-2021-21156/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21157 page", "url": "https://www.suse.com/security/cve/CVE-2021-21157/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21159 page", "url": "https://www.suse.com/security/cve/CVE-2021-21159/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21160 page", "url": "https://www.suse.com/security/cve/CVE-2021-21160/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21161 page", "url": "https://www.suse.com/security/cve/CVE-2021-21161/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21162 page", "url": "https://www.suse.com/security/cve/CVE-2021-21162/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21163 page", "url": "https://www.suse.com/security/cve/CVE-2021-21163/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21164 page", "url": "https://www.suse.com/security/cve/CVE-2021-21164/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21165 page", "url": "https://www.suse.com/security/cve/CVE-2021-21165/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21166 page", "url": "https://www.suse.com/security/cve/CVE-2021-21166/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21167 page", "url": "https://www.suse.com/security/cve/CVE-2021-21167/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21168 page", "url": "https://www.suse.com/security/cve/CVE-2021-21168/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21169 page", "url": "https://www.suse.com/security/cve/CVE-2021-21169/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21170 page", "url": "https://www.suse.com/security/cve/CVE-2021-21170/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21171 page", "url": "https://www.suse.com/security/cve/CVE-2021-21171/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21172 page", "url": "https://www.suse.com/security/cve/CVE-2021-21172/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21173 page", "url": "https://www.suse.com/security/cve/CVE-2021-21173/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21174 page", "url": "https://www.suse.com/security/cve/CVE-2021-21174/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21175 page", "url": "https://www.suse.com/security/cve/CVE-2021-21175/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21176 page", "url": "https://www.suse.com/security/cve/CVE-2021-21176/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21177 page", "url": "https://www.suse.com/security/cve/CVE-2021-21177/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21178 page", "url": "https://www.suse.com/security/cve/CVE-2021-21178/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21179 page", "url": "https://www.suse.com/security/cve/CVE-2021-21179/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21180 page", "url": "https://www.suse.com/security/cve/CVE-2021-21180/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21181 page", "url": "https://www.suse.com/security/cve/CVE-2021-21181/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21182 page", "url": "https://www.suse.com/security/cve/CVE-2021-21182/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21183 page", "url": "https://www.suse.com/security/cve/CVE-2021-21183/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21184 page", "url": "https://www.suse.com/security/cve/CVE-2021-21184/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21185 page", "url": "https://www.suse.com/security/cve/CVE-2021-21185/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21186 page", "url": "https://www.suse.com/security/cve/CVE-2021-21186/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21187 page", "url": "https://www.suse.com/security/cve/CVE-2021-21187/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21188 page", "url": "https://www.suse.com/security/cve/CVE-2021-21188/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21189 page", "url": "https://www.suse.com/security/cve/CVE-2021-21189/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21190 page", "url": "https://www.suse.com/security/cve/CVE-2021-21190/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21191 page", "url": "https://www.suse.com/security/cve/CVE-2021-21191/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21192 page", "url": "https://www.suse.com/security/cve/CVE-2021-21192/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21193 page", "url": "https://www.suse.com/security/cve/CVE-2021-21193/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21194 page", "url": "https://www.suse.com/security/cve/CVE-2021-21194/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21195 page", "url": "https://www.suse.com/security/cve/CVE-2021-21195/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21196 page", "url": "https://www.suse.com/security/cve/CVE-2021-21196/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21197 page", "url": "https://www.suse.com/security/cve/CVE-2021-21197/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21198 page", "url": "https://www.suse.com/security/cve/CVE-2021-21198/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21199 page", "url": "https://www.suse.com/security/cve/CVE-2021-21199/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21201 page", "url": "https://www.suse.com/security/cve/CVE-2021-21201/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21202 page", "url": "https://www.suse.com/security/cve/CVE-2021-21202/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21203 page", "url": "https://www.suse.com/security/cve/CVE-2021-21203/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21204 page", "url": "https://www.suse.com/security/cve/CVE-2021-21204/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21205 page", "url": "https://www.suse.com/security/cve/CVE-2021-21205/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21206 page", "url": "https://www.suse.com/security/cve/CVE-2021-21206/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21207 page", "url": "https://www.suse.com/security/cve/CVE-2021-21207/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21208 page", "url": "https://www.suse.com/security/cve/CVE-2021-21208/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21209 page", "url": "https://www.suse.com/security/cve/CVE-2021-21209/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21210 page", "url": "https://www.suse.com/security/cve/CVE-2021-21210/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21211 page", "url": "https://www.suse.com/security/cve/CVE-2021-21211/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21212 page", "url": "https://www.suse.com/security/cve/CVE-2021-21212/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21213 page", "url": "https://www.suse.com/security/cve/CVE-2021-21213/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21214 page", "url": "https://www.suse.com/security/cve/CVE-2021-21214/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21215 page", "url": "https://www.suse.com/security/cve/CVE-2021-21215/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21216 page", "url": "https://www.suse.com/security/cve/CVE-2021-21216/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21217 page", "url": "https://www.suse.com/security/cve/CVE-2021-21217/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21218 page", "url": "https://www.suse.com/security/cve/CVE-2021-21218/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21219 page", "url": "https://www.suse.com/security/cve/CVE-2021-21219/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21220 page", "url": "https://www.suse.com/security/cve/CVE-2021-21220/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21221 page", "url": "https://www.suse.com/security/cve/CVE-2021-21221/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21222 page", "url": "https://www.suse.com/security/cve/CVE-2021-21222/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21223 page", "url": "https://www.suse.com/security/cve/CVE-2021-21223/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21224 page", "url": "https://www.suse.com/security/cve/CVE-2021-21224/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21225 page", "url": "https://www.suse.com/security/cve/CVE-2021-21225/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21226 page", "url": "https://www.suse.com/security/cve/CVE-2021-21226/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21227 page", "url": "https://www.suse.com/security/cve/CVE-2021-21227/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21228 page", "url": "https://www.suse.com/security/cve/CVE-2021-21228/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21229 page", "url": "https://www.suse.com/security/cve/CVE-2021-21229/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21230 page", "url": "https://www.suse.com/security/cve/CVE-2021-21230/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21231 page", "url": "https://www.suse.com/security/cve/CVE-2021-21231/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21232 page", "url": "https://www.suse.com/security/cve/CVE-2021-21232/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-21233 page", "url": "https://www.suse.com/security/cve/CVE-2021-21233/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30506 page", "url": "https://www.suse.com/security/cve/CVE-2021-30506/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30507 page", "url": "https://www.suse.com/security/cve/CVE-2021-30507/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30508 page", "url": "https://www.suse.com/security/cve/CVE-2021-30508/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30509 page", "url": "https://www.suse.com/security/cve/CVE-2021-30509/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30510 page", "url": "https://www.suse.com/security/cve/CVE-2021-30510/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30511 page", "url": "https://www.suse.com/security/cve/CVE-2021-30511/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30512 page", "url": "https://www.suse.com/security/cve/CVE-2021-30512/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30513 page", "url": "https://www.suse.com/security/cve/CVE-2021-30513/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30514 page", "url": "https://www.suse.com/security/cve/CVE-2021-30514/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30515 page", "url": "https://www.suse.com/security/cve/CVE-2021-30515/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30516 page", "url": "https://www.suse.com/security/cve/CVE-2021-30516/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30517 page", "url": "https://www.suse.com/security/cve/CVE-2021-30517/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30518 page", "url": "https://www.suse.com/security/cve/CVE-2021-30518/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30519 page", "url": "https://www.suse.com/security/cve/CVE-2021-30519/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30520 page", "url": "https://www.suse.com/security/cve/CVE-2021-30520/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30521 page", "url": "https://www.suse.com/security/cve/CVE-2021-30521/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30522 page", "url": "https://www.suse.com/security/cve/CVE-2021-30522/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30523 page", "url": "https://www.suse.com/security/cve/CVE-2021-30523/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30524 page", "url": "https://www.suse.com/security/cve/CVE-2021-30524/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30525 page", "url": "https://www.suse.com/security/cve/CVE-2021-30525/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30526 page", "url": "https://www.suse.com/security/cve/CVE-2021-30526/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30527 page", "url": "https://www.suse.com/security/cve/CVE-2021-30527/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30528 page", "url": "https://www.suse.com/security/cve/CVE-2021-30528/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30529 page", "url": "https://www.suse.com/security/cve/CVE-2021-30529/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30530 page", "url": "https://www.suse.com/security/cve/CVE-2021-30530/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30531 page", "url": "https://www.suse.com/security/cve/CVE-2021-30531/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30532 page", "url": "https://www.suse.com/security/cve/CVE-2021-30532/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30533 page", "url": "https://www.suse.com/security/cve/CVE-2021-30533/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30534 page", "url": "https://www.suse.com/security/cve/CVE-2021-30534/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30535 page", "url": "https://www.suse.com/security/cve/CVE-2021-30535/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30536 page", "url": "https://www.suse.com/security/cve/CVE-2021-30536/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30537 page", "url": "https://www.suse.com/security/cve/CVE-2021-30537/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30538 page", "url": "https://www.suse.com/security/cve/CVE-2021-30538/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30539 page", "url": "https://www.suse.com/security/cve/CVE-2021-30539/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30540 page", "url": "https://www.suse.com/security/cve/CVE-2021-30540/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30541 page", "url": "https://www.suse.com/security/cve/CVE-2021-30541/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30544 page", "url": "https://www.suse.com/security/cve/CVE-2021-30544/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30545 page", "url": "https://www.suse.com/security/cve/CVE-2021-30545/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30546 page", "url": "https://www.suse.com/security/cve/CVE-2021-30546/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30547 page", "url": "https://www.suse.com/security/cve/CVE-2021-30547/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30548 page", "url": "https://www.suse.com/security/cve/CVE-2021-30548/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30549 page", "url": "https://www.suse.com/security/cve/CVE-2021-30549/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30550 page", "url": "https://www.suse.com/security/cve/CVE-2021-30550/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30551 page", "url": "https://www.suse.com/security/cve/CVE-2021-30551/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30552 page", "url": "https://www.suse.com/security/cve/CVE-2021-30552/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30553 page", "url": "https://www.suse.com/security/cve/CVE-2021-30553/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30554 page", "url": "https://www.suse.com/security/cve/CVE-2021-30554/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30555 page", "url": "https://www.suse.com/security/cve/CVE-2021-30555/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30556 page", "url": "https://www.suse.com/security/cve/CVE-2021-30556/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30557 page", "url": "https://www.suse.com/security/cve/CVE-2021-30557/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30559 page", "url": "https://www.suse.com/security/cve/CVE-2021-30559/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30560 page", "url": "https://www.suse.com/security/cve/CVE-2021-30560/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30561 page", "url": "https://www.suse.com/security/cve/CVE-2021-30561/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30562 page", "url": "https://www.suse.com/security/cve/CVE-2021-30562/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30563 page", "url": "https://www.suse.com/security/cve/CVE-2021-30563/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30564 page", "url": "https://www.suse.com/security/cve/CVE-2021-30564/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30565 page", "url": "https://www.suse.com/security/cve/CVE-2021-30565/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30566 page", "url": "https://www.suse.com/security/cve/CVE-2021-30566/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30567 page", "url": "https://www.suse.com/security/cve/CVE-2021-30567/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30568 page", "url": "https://www.suse.com/security/cve/CVE-2021-30568/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30569 page", "url": "https://www.suse.com/security/cve/CVE-2021-30569/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30571 page", "url": "https://www.suse.com/security/cve/CVE-2021-30571/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30572 page", "url": "https://www.suse.com/security/cve/CVE-2021-30572/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30573 page", "url": "https://www.suse.com/security/cve/CVE-2021-30573/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30574 page", "url": "https://www.suse.com/security/cve/CVE-2021-30574/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30575 page", "url": "https://www.suse.com/security/cve/CVE-2021-30575/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30576 page", "url": "https://www.suse.com/security/cve/CVE-2021-30576/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30577 page", "url": "https://www.suse.com/security/cve/CVE-2021-30577/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30578 page", "url": "https://www.suse.com/security/cve/CVE-2021-30578/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30579 page", "url": "https://www.suse.com/security/cve/CVE-2021-30579/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30581 page", "url": "https://www.suse.com/security/cve/CVE-2021-30581/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30582 page", "url": "https://www.suse.com/security/cve/CVE-2021-30582/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30584 page", "url": "https://www.suse.com/security/cve/CVE-2021-30584/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30585 page", "url": "https://www.suse.com/security/cve/CVE-2021-30585/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30588 page", "url": "https://www.suse.com/security/cve/CVE-2021-30588/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30589 page", "url": "https://www.suse.com/security/cve/CVE-2021-30589/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30590 page", "url": "https://www.suse.com/security/cve/CVE-2021-30590/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30591 page", "url": "https://www.suse.com/security/cve/CVE-2021-30591/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30592 page", "url": "https://www.suse.com/security/cve/CVE-2021-30592/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30593 page", "url": "https://www.suse.com/security/cve/CVE-2021-30593/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30594 page", "url": "https://www.suse.com/security/cve/CVE-2021-30594/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30596 page", "url": "https://www.suse.com/security/cve/CVE-2021-30596/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30597 page", "url": "https://www.suse.com/security/cve/CVE-2021-30597/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30598 page", "url": "https://www.suse.com/security/cve/CVE-2021-30598/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30599 page", "url": "https://www.suse.com/security/cve/CVE-2021-30599/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30600 page", "url": "https://www.suse.com/security/cve/CVE-2021-30600/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30601 page", "url": "https://www.suse.com/security/cve/CVE-2021-30601/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30602 page", "url": "https://www.suse.com/security/cve/CVE-2021-30602/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30603 page", "url": "https://www.suse.com/security/cve/CVE-2021-30603/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30604 page", "url": "https://www.suse.com/security/cve/CVE-2021-30604/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30606 page", "url": "https://www.suse.com/security/cve/CVE-2021-30606/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30607 page", "url": "https://www.suse.com/security/cve/CVE-2021-30607/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30608 page", "url": "https://www.suse.com/security/cve/CVE-2021-30608/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30609 page", "url": "https://www.suse.com/security/cve/CVE-2021-30609/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30610 page", "url": "https://www.suse.com/security/cve/CVE-2021-30610/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30611 page", "url": "https://www.suse.com/security/cve/CVE-2021-30611/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30612 page", "url": "https://www.suse.com/security/cve/CVE-2021-30612/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30613 page", "url": "https://www.suse.com/security/cve/CVE-2021-30613/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30614 page", "url": "https://www.suse.com/security/cve/CVE-2021-30614/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30615 page", "url": "https://www.suse.com/security/cve/CVE-2021-30615/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30616 page", "url": "https://www.suse.com/security/cve/CVE-2021-30616/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30617 page", "url": "https://www.suse.com/security/cve/CVE-2021-30617/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30618 page", "url": "https://www.suse.com/security/cve/CVE-2021-30618/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30619 page", "url": "https://www.suse.com/security/cve/CVE-2021-30619/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30620 page", "url": "https://www.suse.com/security/cve/CVE-2021-30620/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30621 page", "url": "https://www.suse.com/security/cve/CVE-2021-30621/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30622 page", "url": "https://www.suse.com/security/cve/CVE-2021-30622/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30623 page", "url": "https://www.suse.com/security/cve/CVE-2021-30623/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30624 page", "url": "https://www.suse.com/security/cve/CVE-2021-30624/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30625 page", "url": "https://www.suse.com/security/cve/CVE-2021-30625/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30626 page", "url": "https://www.suse.com/security/cve/CVE-2021-30626/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30627 page", "url": "https://www.suse.com/security/cve/CVE-2021-30627/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30628 page", "url": "https://www.suse.com/security/cve/CVE-2021-30628/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30629 page", "url": "https://www.suse.com/security/cve/CVE-2021-30629/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30630 page", "url": "https://www.suse.com/security/cve/CVE-2021-30630/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30631 page", "url": "https://www.suse.com/security/cve/CVE-2021-30631/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30632 page", "url": "https://www.suse.com/security/cve/CVE-2021-30632/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-30633 page", "url": "https://www.suse.com/security/cve/CVE-2021-30633/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37956 page", "url": "https://www.suse.com/security/cve/CVE-2021-37956/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37957 page", "url": "https://www.suse.com/security/cve/CVE-2021-37957/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37958 page", "url": "https://www.suse.com/security/cve/CVE-2021-37958/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37959 page", "url": "https://www.suse.com/security/cve/CVE-2021-37959/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37960 page", "url": "https://www.suse.com/security/cve/CVE-2021-37960/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37961 page", "url": "https://www.suse.com/security/cve/CVE-2021-37961/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37962 page", "url": "https://www.suse.com/security/cve/CVE-2021-37962/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37963 page", "url": "https://www.suse.com/security/cve/CVE-2021-37963/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37964 page", "url": "https://www.suse.com/security/cve/CVE-2021-37964/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37965 page", "url": "https://www.suse.com/security/cve/CVE-2021-37965/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37966 page", "url": "https://www.suse.com/security/cve/CVE-2021-37966/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37967 page", "url": "https://www.suse.com/security/cve/CVE-2021-37967/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37968 page", "url": "https://www.suse.com/security/cve/CVE-2021-37968/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37969 page", "url": "https://www.suse.com/security/cve/CVE-2021-37969/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37970 page", "url": "https://www.suse.com/security/cve/CVE-2021-37970/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37971 page", "url": "https://www.suse.com/security/cve/CVE-2021-37971/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37972 page", "url": "https://www.suse.com/security/cve/CVE-2021-37972/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37973 page", "url": "https://www.suse.com/security/cve/CVE-2021-37973/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37974 page", "url": "https://www.suse.com/security/cve/CVE-2021-37974/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37975 page", "url": "https://www.suse.com/security/cve/CVE-2021-37975/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37976 page", "url": "https://www.suse.com/security/cve/CVE-2021-37976/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37977 page", "url": "https://www.suse.com/security/cve/CVE-2021-37977/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37978 page", "url": "https://www.suse.com/security/cve/CVE-2021-37978/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37979 page", "url": "https://www.suse.com/security/cve/CVE-2021-37979/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37980 page", "url": "https://www.suse.com/security/cve/CVE-2021-37980/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37981 page", "url": "https://www.suse.com/security/cve/CVE-2021-37981/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37982 page", "url": "https://www.suse.com/security/cve/CVE-2021-37982/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37983 page", "url": "https://www.suse.com/security/cve/CVE-2021-37983/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37984 page", "url": "https://www.suse.com/security/cve/CVE-2021-37984/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37985 page", "url": "https://www.suse.com/security/cve/CVE-2021-37985/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37986 page", "url": "https://www.suse.com/security/cve/CVE-2021-37986/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37987 page", "url": "https://www.suse.com/security/cve/CVE-2021-37987/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37988 page", "url": "https://www.suse.com/security/cve/CVE-2021-37988/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37989 page", "url": "https://www.suse.com/security/cve/CVE-2021-37989/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37990 page", "url": "https://www.suse.com/security/cve/CVE-2021-37990/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37991 page", "url": "https://www.suse.com/security/cve/CVE-2021-37991/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37992 page", "url": "https://www.suse.com/security/cve/CVE-2021-37992/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37993 page", "url": "https://www.suse.com/security/cve/CVE-2021-37993/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37994 page", "url": "https://www.suse.com/security/cve/CVE-2021-37994/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37995 page", "url": "https://www.suse.com/security/cve/CVE-2021-37995/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37996 page", "url": "https://www.suse.com/security/cve/CVE-2021-37996/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37997 page", "url": "https://www.suse.com/security/cve/CVE-2021-37997/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37998 page", "url": "https://www.suse.com/security/cve/CVE-2021-37998/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-37999 page", "url": "https://www.suse.com/security/cve/CVE-2021-37999/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38000 page", "url": "https://www.suse.com/security/cve/CVE-2021-38000/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38001 page", "url": "https://www.suse.com/security/cve/CVE-2021-38001/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38002 page", "url": "https://www.suse.com/security/cve/CVE-2021-38002/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38003 page", "url": "https://www.suse.com/security/cve/CVE-2021-38003/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38005 page", "url": "https://www.suse.com/security/cve/CVE-2021-38005/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38006 page", "url": "https://www.suse.com/security/cve/CVE-2021-38006/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38007 page", "url": "https://www.suse.com/security/cve/CVE-2021-38007/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38008 page", "url": "https://www.suse.com/security/cve/CVE-2021-38008/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38009 page", "url": "https://www.suse.com/security/cve/CVE-2021-38009/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38010 page", "url": "https://www.suse.com/security/cve/CVE-2021-38010/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38011 page", "url": "https://www.suse.com/security/cve/CVE-2021-38011/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38012 page", "url": "https://www.suse.com/security/cve/CVE-2021-38012/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38013 page", "url": "https://www.suse.com/security/cve/CVE-2021-38013/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38014 page", "url": "https://www.suse.com/security/cve/CVE-2021-38014/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38015 page", "url": "https://www.suse.com/security/cve/CVE-2021-38015/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38016 page", "url": "https://www.suse.com/security/cve/CVE-2021-38016/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38017 page", "url": "https://www.suse.com/security/cve/CVE-2021-38017/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38018 page", "url": "https://www.suse.com/security/cve/CVE-2021-38018/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38019 page", "url": "https://www.suse.com/security/cve/CVE-2021-38019/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38020 page", "url": "https://www.suse.com/security/cve/CVE-2021-38020/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38021 page", "url": "https://www.suse.com/security/cve/CVE-2021-38021/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-38022 page", "url": "https://www.suse.com/security/cve/CVE-2021-38022/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4052 page", "url": "https://www.suse.com/security/cve/CVE-2021-4052/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4053 page", "url": "https://www.suse.com/security/cve/CVE-2021-4053/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4054 page", "url": "https://www.suse.com/security/cve/CVE-2021-4054/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4055 page", "url": "https://www.suse.com/security/cve/CVE-2021-4055/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4056 page", "url": "https://www.suse.com/security/cve/CVE-2021-4056/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4057 page", "url": "https://www.suse.com/security/cve/CVE-2021-4057/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4058 page", "url": "https://www.suse.com/security/cve/CVE-2021-4058/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4059 page", "url": "https://www.suse.com/security/cve/CVE-2021-4059/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4061 page", "url": "https://www.suse.com/security/cve/CVE-2021-4061/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4062 page", "url": "https://www.suse.com/security/cve/CVE-2021-4062/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4063 page", "url": "https://www.suse.com/security/cve/CVE-2021-4063/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4064 page", "url": "https://www.suse.com/security/cve/CVE-2021-4064/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4065 page", "url": "https://www.suse.com/security/cve/CVE-2021-4065/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4066 page", "url": "https://www.suse.com/security/cve/CVE-2021-4066/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4067 page", "url": "https://www.suse.com/security/cve/CVE-2021-4067/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4068 page", "url": "https://www.suse.com/security/cve/CVE-2021-4068/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4078 page", "url": "https://www.suse.com/security/cve/CVE-2021-4078/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4079 page", "url": "https://www.suse.com/security/cve/CVE-2021-4079/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4098 page", "url": "https://www.suse.com/security/cve/CVE-2021-4098/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4099 page", "url": "https://www.suse.com/security/cve/CVE-2021-4099/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4100 page", "url": "https://www.suse.com/security/cve/CVE-2021-4100/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4101 page", "url": "https://www.suse.com/security/cve/CVE-2021-4101/" }, { "category": "self", "summary": "SUSE CVE CVE-2021-4102 page", "url": "https://www.suse.com/security/cve/CVE-2021-4102/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0096 page", "url": "https://www.suse.com/security/cve/CVE-2022-0096/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0097 page", "url": "https://www.suse.com/security/cve/CVE-2022-0097/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0098 page", "url": "https://www.suse.com/security/cve/CVE-2022-0098/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0099 page", "url": "https://www.suse.com/security/cve/CVE-2022-0099/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0100 page", "url": "https://www.suse.com/security/cve/CVE-2022-0100/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0101 page", "url": "https://www.suse.com/security/cve/CVE-2022-0101/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0102 page", "url": "https://www.suse.com/security/cve/CVE-2022-0102/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0103 page", "url": "https://www.suse.com/security/cve/CVE-2022-0103/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0104 page", "url": "https://www.suse.com/security/cve/CVE-2022-0104/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0105 page", "url": "https://www.suse.com/security/cve/CVE-2022-0105/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0106 page", "url": "https://www.suse.com/security/cve/CVE-2022-0106/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0107 page", "url": "https://www.suse.com/security/cve/CVE-2022-0107/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0108 page", "url": "https://www.suse.com/security/cve/CVE-2022-0108/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0109 page", "url": "https://www.suse.com/security/cve/CVE-2022-0109/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0110 page", "url": "https://www.suse.com/security/cve/CVE-2022-0110/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0111 page", "url": "https://www.suse.com/security/cve/CVE-2022-0111/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0112 page", "url": "https://www.suse.com/security/cve/CVE-2022-0112/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0113 page", "url": "https://www.suse.com/security/cve/CVE-2022-0113/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0114 page", "url": "https://www.suse.com/security/cve/CVE-2022-0114/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0115 page", "url": "https://www.suse.com/security/cve/CVE-2022-0115/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0116 page", "url": "https://www.suse.com/security/cve/CVE-2022-0116/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0117 page", "url": "https://www.suse.com/security/cve/CVE-2022-0117/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0118 page", "url": "https://www.suse.com/security/cve/CVE-2022-0118/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0120 page", "url": "https://www.suse.com/security/cve/CVE-2022-0120/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0289 page", "url": "https://www.suse.com/security/cve/CVE-2022-0289/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0290 page", "url": "https://www.suse.com/security/cve/CVE-2022-0290/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0291 page", "url": "https://www.suse.com/security/cve/CVE-2022-0291/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0292 page", "url": "https://www.suse.com/security/cve/CVE-2022-0292/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0293 page", "url": "https://www.suse.com/security/cve/CVE-2022-0293/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0294 page", "url": "https://www.suse.com/security/cve/CVE-2022-0294/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0295 page", "url": "https://www.suse.com/security/cve/CVE-2022-0295/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0296 page", "url": "https://www.suse.com/security/cve/CVE-2022-0296/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0297 page", "url": "https://www.suse.com/security/cve/CVE-2022-0297/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0298 page", "url": "https://www.suse.com/security/cve/CVE-2022-0298/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0300 page", "url": "https://www.suse.com/security/cve/CVE-2022-0300/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0301 page", "url": "https://www.suse.com/security/cve/CVE-2022-0301/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0302 page", "url": "https://www.suse.com/security/cve/CVE-2022-0302/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0303 page", "url": "https://www.suse.com/security/cve/CVE-2022-0303/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0304 page", "url": "https://www.suse.com/security/cve/CVE-2022-0304/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0305 page", "url": "https://www.suse.com/security/cve/CVE-2022-0305/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0306 page", "url": "https://www.suse.com/security/cve/CVE-2022-0306/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0307 page", "url": "https://www.suse.com/security/cve/CVE-2022-0307/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0308 page", "url": "https://www.suse.com/security/cve/CVE-2022-0308/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0309 page", "url": "https://www.suse.com/security/cve/CVE-2022-0309/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0310 page", "url": "https://www.suse.com/security/cve/CVE-2022-0310/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0311 page", "url": "https://www.suse.com/security/cve/CVE-2022-0311/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0452 page", "url": "https://www.suse.com/security/cve/CVE-2022-0452/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0453 page", "url": "https://www.suse.com/security/cve/CVE-2022-0453/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0454 page", "url": "https://www.suse.com/security/cve/CVE-2022-0454/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0455 page", "url": "https://www.suse.com/security/cve/CVE-2022-0455/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0456 page", "url": "https://www.suse.com/security/cve/CVE-2022-0456/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0457 page", "url": "https://www.suse.com/security/cve/CVE-2022-0457/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0459 page", "url": "https://www.suse.com/security/cve/CVE-2022-0459/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0460 page", "url": "https://www.suse.com/security/cve/CVE-2022-0460/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0461 page", "url": "https://www.suse.com/security/cve/CVE-2022-0461/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0462 page", "url": "https://www.suse.com/security/cve/CVE-2022-0462/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0463 page", "url": "https://www.suse.com/security/cve/CVE-2022-0463/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0464 page", "url": "https://www.suse.com/security/cve/CVE-2022-0464/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0465 page", "url": "https://www.suse.com/security/cve/CVE-2022-0465/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0466 page", "url": "https://www.suse.com/security/cve/CVE-2022-0466/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0467 page", "url": "https://www.suse.com/security/cve/CVE-2022-0467/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0468 page", "url": "https://www.suse.com/security/cve/CVE-2022-0468/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0469 page", "url": "https://www.suse.com/security/cve/CVE-2022-0469/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0470 page", "url": "https://www.suse.com/security/cve/CVE-2022-0470/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0603 page", "url": "https://www.suse.com/security/cve/CVE-2022-0603/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0604 page", "url": "https://www.suse.com/security/cve/CVE-2022-0604/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0605 page", "url": "https://www.suse.com/security/cve/CVE-2022-0605/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0606 page", "url": "https://www.suse.com/security/cve/CVE-2022-0606/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0607 page", "url": "https://www.suse.com/security/cve/CVE-2022-0607/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0608 page", "url": "https://www.suse.com/security/cve/CVE-2022-0608/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0609 page", "url": "https://www.suse.com/security/cve/CVE-2022-0609/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0610 page", "url": "https://www.suse.com/security/cve/CVE-2022-0610/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0789 page", "url": "https://www.suse.com/security/cve/CVE-2022-0789/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0790 page", "url": "https://www.suse.com/security/cve/CVE-2022-0790/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0791 page", "url": "https://www.suse.com/security/cve/CVE-2022-0791/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0792 page", "url": "https://www.suse.com/security/cve/CVE-2022-0792/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0793 page", "url": "https://www.suse.com/security/cve/CVE-2022-0793/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0794 page", "url": "https://www.suse.com/security/cve/CVE-2022-0794/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0795 page", "url": "https://www.suse.com/security/cve/CVE-2022-0795/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0796 page", "url": "https://www.suse.com/security/cve/CVE-2022-0796/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0797 page", "url": "https://www.suse.com/security/cve/CVE-2022-0797/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0798 page", "url": "https://www.suse.com/security/cve/CVE-2022-0798/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0799 page", "url": "https://www.suse.com/security/cve/CVE-2022-0799/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0800 page", "url": "https://www.suse.com/security/cve/CVE-2022-0800/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0801 page", "url": "https://www.suse.com/security/cve/CVE-2022-0801/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0802 page", "url": "https://www.suse.com/security/cve/CVE-2022-0802/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0803 page", "url": "https://www.suse.com/security/cve/CVE-2022-0803/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0804 page", "url": "https://www.suse.com/security/cve/CVE-2022-0804/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0805 page", "url": "https://www.suse.com/security/cve/CVE-2022-0805/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0806 page", "url": "https://www.suse.com/security/cve/CVE-2022-0806/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0807 page", "url": "https://www.suse.com/security/cve/CVE-2022-0807/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0808 page", "url": "https://www.suse.com/security/cve/CVE-2022-0808/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0809 page", "url": "https://www.suse.com/security/cve/CVE-2022-0809/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0971 page", "url": "https://www.suse.com/security/cve/CVE-2022-0971/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0972 page", "url": "https://www.suse.com/security/cve/CVE-2022-0972/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0973 page", "url": "https://www.suse.com/security/cve/CVE-2022-0973/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0974 page", "url": "https://www.suse.com/security/cve/CVE-2022-0974/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0975 page", "url": "https://www.suse.com/security/cve/CVE-2022-0975/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0976 page", "url": "https://www.suse.com/security/cve/CVE-2022-0976/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0977 page", "url": "https://www.suse.com/security/cve/CVE-2022-0977/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0978 page", "url": "https://www.suse.com/security/cve/CVE-2022-0978/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0979 page", "url": "https://www.suse.com/security/cve/CVE-2022-0979/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-0980 page", "url": "https://www.suse.com/security/cve/CVE-2022-0980/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1096 page", "url": "https://www.suse.com/security/cve/CVE-2022-1096/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1125 page", "url": "https://www.suse.com/security/cve/CVE-2022-1125/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1127 page", "url": "https://www.suse.com/security/cve/CVE-2022-1127/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1128 page", "url": "https://www.suse.com/security/cve/CVE-2022-1128/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1129 page", "url": "https://www.suse.com/security/cve/CVE-2022-1129/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1130 page", "url": "https://www.suse.com/security/cve/CVE-2022-1130/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1131 page", "url": "https://www.suse.com/security/cve/CVE-2022-1131/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1132 page", "url": "https://www.suse.com/security/cve/CVE-2022-1132/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1133 page", "url": "https://www.suse.com/security/cve/CVE-2022-1133/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1134 page", "url": "https://www.suse.com/security/cve/CVE-2022-1134/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1135 page", "url": "https://www.suse.com/security/cve/CVE-2022-1135/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1136 page", "url": "https://www.suse.com/security/cve/CVE-2022-1136/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1137 page", "url": "https://www.suse.com/security/cve/CVE-2022-1137/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1138 page", "url": "https://www.suse.com/security/cve/CVE-2022-1138/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1139 page", "url": "https://www.suse.com/security/cve/CVE-2022-1139/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1141 page", "url": "https://www.suse.com/security/cve/CVE-2022-1141/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1142 page", "url": "https://www.suse.com/security/cve/CVE-2022-1142/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1143 page", "url": "https://www.suse.com/security/cve/CVE-2022-1143/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1144 page", "url": "https://www.suse.com/security/cve/CVE-2022-1144/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1145 page", "url": "https://www.suse.com/security/cve/CVE-2022-1145/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1146 page", "url": "https://www.suse.com/security/cve/CVE-2022-1146/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1232 page", "url": "https://www.suse.com/security/cve/CVE-2022-1232/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1305 page", "url": "https://www.suse.com/security/cve/CVE-2022-1305/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1306 page", "url": "https://www.suse.com/security/cve/CVE-2022-1306/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1307 page", "url": "https://www.suse.com/security/cve/CVE-2022-1307/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1308 page", "url": "https://www.suse.com/security/cve/CVE-2022-1308/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1309 page", "url": "https://www.suse.com/security/cve/CVE-2022-1309/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1310 page", "url": "https://www.suse.com/security/cve/CVE-2022-1310/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1311 page", "url": "https://www.suse.com/security/cve/CVE-2022-1311/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1312 page", "url": "https://www.suse.com/security/cve/CVE-2022-1312/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1313 page", "url": "https://www.suse.com/security/cve/CVE-2022-1313/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1314 page", "url": "https://www.suse.com/security/cve/CVE-2022-1314/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1364 page", "url": "https://www.suse.com/security/cve/CVE-2022-1364/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1477 page", "url": "https://www.suse.com/security/cve/CVE-2022-1477/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1478 page", "url": "https://www.suse.com/security/cve/CVE-2022-1478/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1479 page", "url": "https://www.suse.com/security/cve/CVE-2022-1479/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1480 page", "url": "https://www.suse.com/security/cve/CVE-2022-1480/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1481 page", "url": "https://www.suse.com/security/cve/CVE-2022-1481/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1482 page", "url": "https://www.suse.com/security/cve/CVE-2022-1482/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1483 page", "url": "https://www.suse.com/security/cve/CVE-2022-1483/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1484 page", "url": "https://www.suse.com/security/cve/CVE-2022-1484/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1485 page", "url": "https://www.suse.com/security/cve/CVE-2022-1485/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1486 page", "url": "https://www.suse.com/security/cve/CVE-2022-1486/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1487 page", "url": "https://www.suse.com/security/cve/CVE-2022-1487/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1488 page", "url": "https://www.suse.com/security/cve/CVE-2022-1488/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1489 page", "url": "https://www.suse.com/security/cve/CVE-2022-1489/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1490 page", "url": "https://www.suse.com/security/cve/CVE-2022-1490/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1491 page", "url": "https://www.suse.com/security/cve/CVE-2022-1491/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1492 page", "url": "https://www.suse.com/security/cve/CVE-2022-1492/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1493 page", "url": "https://www.suse.com/security/cve/CVE-2022-1493/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1494 page", "url": "https://www.suse.com/security/cve/CVE-2022-1494/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1495 page", "url": "https://www.suse.com/security/cve/CVE-2022-1495/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1496 page", "url": "https://www.suse.com/security/cve/CVE-2022-1496/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1497 page", "url": "https://www.suse.com/security/cve/CVE-2022-1497/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1498 page", "url": "https://www.suse.com/security/cve/CVE-2022-1498/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1499 page", "url": "https://www.suse.com/security/cve/CVE-2022-1499/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1500 page", "url": "https://www.suse.com/security/cve/CVE-2022-1500/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1501 page", "url": "https://www.suse.com/security/cve/CVE-2022-1501/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1633 page", "url": "https://www.suse.com/security/cve/CVE-2022-1633/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1634 page", "url": "https://www.suse.com/security/cve/CVE-2022-1634/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1635 page", "url": "https://www.suse.com/security/cve/CVE-2022-1635/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1636 page", "url": "https://www.suse.com/security/cve/CVE-2022-1636/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1637 page", "url": "https://www.suse.com/security/cve/CVE-2022-1637/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1638 page", "url": "https://www.suse.com/security/cve/CVE-2022-1638/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1639 page", "url": "https://www.suse.com/security/cve/CVE-2022-1639/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1640 page", "url": "https://www.suse.com/security/cve/CVE-2022-1640/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1641 page", "url": "https://www.suse.com/security/cve/CVE-2022-1641/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1853 page", "url": "https://www.suse.com/security/cve/CVE-2022-1853/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1854 page", "url": "https://www.suse.com/security/cve/CVE-2022-1854/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1855 page", "url": "https://www.suse.com/security/cve/CVE-2022-1855/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1856 page", "url": "https://www.suse.com/security/cve/CVE-2022-1856/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1857 page", "url": "https://www.suse.com/security/cve/CVE-2022-1857/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1858 page", "url": "https://www.suse.com/security/cve/CVE-2022-1858/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1859 page", "url": "https://www.suse.com/security/cve/CVE-2022-1859/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1860 page", "url": "https://www.suse.com/security/cve/CVE-2022-1860/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1861 page", "url": "https://www.suse.com/security/cve/CVE-2022-1861/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1862 page", "url": "https://www.suse.com/security/cve/CVE-2022-1862/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1863 page", "url": "https://www.suse.com/security/cve/CVE-2022-1863/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1864 page", "url": "https://www.suse.com/security/cve/CVE-2022-1864/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1865 page", "url": "https://www.suse.com/security/cve/CVE-2022-1865/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1866 page", "url": "https://www.suse.com/security/cve/CVE-2022-1866/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1867 page", "url": "https://www.suse.com/security/cve/CVE-2022-1867/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1868 page", "url": "https://www.suse.com/security/cve/CVE-2022-1868/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1869 page", "url": "https://www.suse.com/security/cve/CVE-2022-1869/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1870 page", "url": "https://www.suse.com/security/cve/CVE-2022-1870/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1871 page", "url": "https://www.suse.com/security/cve/CVE-2022-1871/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1872 page", "url": "https://www.suse.com/security/cve/CVE-2022-1872/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1873 page", "url": "https://www.suse.com/security/cve/CVE-2022-1873/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1874 page", "url": "https://www.suse.com/security/cve/CVE-2022-1874/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1875 page", "url": "https://www.suse.com/security/cve/CVE-2022-1875/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-1876 page", "url": "https://www.suse.com/security/cve/CVE-2022-1876/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2007 page", "url": "https://www.suse.com/security/cve/CVE-2022-2007/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2008 page", "url": "https://www.suse.com/security/cve/CVE-2022-2008/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2010 page", "url": "https://www.suse.com/security/cve/CVE-2022-2010/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2011 page", "url": "https://www.suse.com/security/cve/CVE-2022-2011/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2156 page", "url": "https://www.suse.com/security/cve/CVE-2022-2156/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2157 page", "url": "https://www.suse.com/security/cve/CVE-2022-2157/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2158 page", "url": "https://www.suse.com/security/cve/CVE-2022-2158/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2160 page", "url": "https://www.suse.com/security/cve/CVE-2022-2160/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2161 page", "url": "https://www.suse.com/security/cve/CVE-2022-2161/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2162 page", "url": "https://www.suse.com/security/cve/CVE-2022-2162/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2163 page", "url": "https://www.suse.com/security/cve/CVE-2022-2163/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2164 page", "url": "https://www.suse.com/security/cve/CVE-2022-2164/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2165 page", "url": "https://www.suse.com/security/cve/CVE-2022-2165/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2294 page", "url": "https://www.suse.com/security/cve/CVE-2022-2294/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2295 page", "url": "https://www.suse.com/security/cve/CVE-2022-2295/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2296 page", "url": "https://www.suse.com/security/cve/CVE-2022-2296/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2477 page", "url": "https://www.suse.com/security/cve/CVE-2022-2477/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2478 page", "url": "https://www.suse.com/security/cve/CVE-2022-2478/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2479 page", "url": "https://www.suse.com/security/cve/CVE-2022-2479/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2480 page", "url": "https://www.suse.com/security/cve/CVE-2022-2480/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2481 page", "url": "https://www.suse.com/security/cve/CVE-2022-2481/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2603 page", "url": "https://www.suse.com/security/cve/CVE-2022-2603/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2604 page", "url": "https://www.suse.com/security/cve/CVE-2022-2604/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2605 page", "url": "https://www.suse.com/security/cve/CVE-2022-2605/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2606 page", "url": "https://www.suse.com/security/cve/CVE-2022-2606/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2607 page", "url": "https://www.suse.com/security/cve/CVE-2022-2607/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2608 page", "url": "https://www.suse.com/security/cve/CVE-2022-2608/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2609 page", "url": "https://www.suse.com/security/cve/CVE-2022-2609/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2610 page", "url": "https://www.suse.com/security/cve/CVE-2022-2610/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2611 page", "url": "https://www.suse.com/security/cve/CVE-2022-2611/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2612 page", "url": "https://www.suse.com/security/cve/CVE-2022-2612/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2613 page", "url": "https://www.suse.com/security/cve/CVE-2022-2613/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2614 page", "url": "https://www.suse.com/security/cve/CVE-2022-2614/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2615 page", "url": "https://www.suse.com/security/cve/CVE-2022-2615/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2616 page", "url": "https://www.suse.com/security/cve/CVE-2022-2616/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2617 page", "url": "https://www.suse.com/security/cve/CVE-2022-2617/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2618 page", "url": "https://www.suse.com/security/cve/CVE-2022-2618/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2619 page", "url": "https://www.suse.com/security/cve/CVE-2022-2619/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2620 page", "url": "https://www.suse.com/security/cve/CVE-2022-2620/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2621 page", "url": "https://www.suse.com/security/cve/CVE-2022-2621/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2622 page", "url": "https://www.suse.com/security/cve/CVE-2022-2622/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2623 page", "url": "https://www.suse.com/security/cve/CVE-2022-2623/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2624 page", "url": "https://www.suse.com/security/cve/CVE-2022-2624/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2852 page", "url": "https://www.suse.com/security/cve/CVE-2022-2852/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2853 page", "url": "https://www.suse.com/security/cve/CVE-2022-2853/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2854 page", "url": "https://www.suse.com/security/cve/CVE-2022-2854/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2855 page", "url": "https://www.suse.com/security/cve/CVE-2022-2855/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2856 page", "url": "https://www.suse.com/security/cve/CVE-2022-2856/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2857 page", "url": "https://www.suse.com/security/cve/CVE-2022-2857/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2858 page", "url": "https://www.suse.com/security/cve/CVE-2022-2858/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2859 page", "url": "https://www.suse.com/security/cve/CVE-2022-2859/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2860 page", "url": "https://www.suse.com/security/cve/CVE-2022-2860/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-2861 page", "url": "https://www.suse.com/security/cve/CVE-2022-2861/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3038 page", "url": "https://www.suse.com/security/cve/CVE-2022-3038/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3039 page", "url": "https://www.suse.com/security/cve/CVE-2022-3039/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3040 page", "url": "https://www.suse.com/security/cve/CVE-2022-3040/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3041 page", "url": "https://www.suse.com/security/cve/CVE-2022-3041/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3042 page", "url": "https://www.suse.com/security/cve/CVE-2022-3042/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3043 page", "url": "https://www.suse.com/security/cve/CVE-2022-3043/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3044 page", "url": "https://www.suse.com/security/cve/CVE-2022-3044/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3045 page", "url": "https://www.suse.com/security/cve/CVE-2022-3045/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3046 page", "url": "https://www.suse.com/security/cve/CVE-2022-3046/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3047 page", "url": "https://www.suse.com/security/cve/CVE-2022-3047/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3048 page", "url": "https://www.suse.com/security/cve/CVE-2022-3048/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3049 page", "url": "https://www.suse.com/security/cve/CVE-2022-3049/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3050 page", "url": "https://www.suse.com/security/cve/CVE-2022-3050/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3051 page", "url": "https://www.suse.com/security/cve/CVE-2022-3051/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3052 page", "url": "https://www.suse.com/security/cve/CVE-2022-3052/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3053 page", "url": "https://www.suse.com/security/cve/CVE-2022-3053/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3054 page", "url": "https://www.suse.com/security/cve/CVE-2022-3054/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3055 page", "url": "https://www.suse.com/security/cve/CVE-2022-3055/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3056 page", "url": "https://www.suse.com/security/cve/CVE-2022-3056/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3057 page", "url": "https://www.suse.com/security/cve/CVE-2022-3057/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3058 page", "url": "https://www.suse.com/security/cve/CVE-2022-3058/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3071 page", "url": "https://www.suse.com/security/cve/CVE-2022-3071/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3075 page", "url": "https://www.suse.com/security/cve/CVE-2022-3075/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3195 page", "url": "https://www.suse.com/security/cve/CVE-2022-3195/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3196 page", "url": "https://www.suse.com/security/cve/CVE-2022-3196/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3197 page", "url": "https://www.suse.com/security/cve/CVE-2022-3197/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3198 page", "url": "https://www.suse.com/security/cve/CVE-2022-3198/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3199 page", "url": "https://www.suse.com/security/cve/CVE-2022-3199/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3200 page", "url": "https://www.suse.com/security/cve/CVE-2022-3200/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3201 page", "url": "https://www.suse.com/security/cve/CVE-2022-3201/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3304 page", "url": "https://www.suse.com/security/cve/CVE-2022-3304/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3305 page", "url": "https://www.suse.com/security/cve/CVE-2022-3305/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3306 page", "url": "https://www.suse.com/security/cve/CVE-2022-3306/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3307 page", "url": "https://www.suse.com/security/cve/CVE-2022-3307/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3308 page", "url": "https://www.suse.com/security/cve/CVE-2022-3308/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3309 page", "url": "https://www.suse.com/security/cve/CVE-2022-3309/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3310 page", "url": "https://www.suse.com/security/cve/CVE-2022-3310/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3311 page", "url": "https://www.suse.com/security/cve/CVE-2022-3311/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3312 page", "url": "https://www.suse.com/security/cve/CVE-2022-3312/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3313 page", "url": "https://www.suse.com/security/cve/CVE-2022-3313/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3314 page", "url": "https://www.suse.com/security/cve/CVE-2022-3314/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3315 page", "url": "https://www.suse.com/security/cve/CVE-2022-3315/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3316 page", "url": "https://www.suse.com/security/cve/CVE-2022-3316/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3317 page", "url": "https://www.suse.com/security/cve/CVE-2022-3317/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3318 page", "url": "https://www.suse.com/security/cve/CVE-2022-3318/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3370 page", "url": "https://www.suse.com/security/cve/CVE-2022-3370/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3373 page", "url": "https://www.suse.com/security/cve/CVE-2022-3373/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3445 page", "url": "https://www.suse.com/security/cve/CVE-2022-3445/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3446 page", "url": "https://www.suse.com/security/cve/CVE-2022-3446/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3447 page", "url": "https://www.suse.com/security/cve/CVE-2022-3447/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3448 page", "url": "https://www.suse.com/security/cve/CVE-2022-3448/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3449 page", "url": "https://www.suse.com/security/cve/CVE-2022-3449/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3450 page", "url": "https://www.suse.com/security/cve/CVE-2022-3450/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3652 page", "url": "https://www.suse.com/security/cve/CVE-2022-3652/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3653 page", "url": "https://www.suse.com/security/cve/CVE-2022-3653/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3654 page", "url": "https://www.suse.com/security/cve/CVE-2022-3654/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3655 page", "url": "https://www.suse.com/security/cve/CVE-2022-3655/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3656 page", "url": "https://www.suse.com/security/cve/CVE-2022-3656/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3657 page", "url": "https://www.suse.com/security/cve/CVE-2022-3657/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3658 page", "url": "https://www.suse.com/security/cve/CVE-2022-3658/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3659 page", "url": "https://www.suse.com/security/cve/CVE-2022-3659/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3660 page", "url": "https://www.suse.com/security/cve/CVE-2022-3660/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3661 page", "url": "https://www.suse.com/security/cve/CVE-2022-3661/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3723 page", "url": "https://www.suse.com/security/cve/CVE-2022-3723/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3885 page", "url": "https://www.suse.com/security/cve/CVE-2022-3885/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3886 page", "url": "https://www.suse.com/security/cve/CVE-2022-3886/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3887 page", "url": "https://www.suse.com/security/cve/CVE-2022-3887/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3888 page", "url": "https://www.suse.com/security/cve/CVE-2022-3888/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3889 page", "url": "https://www.suse.com/security/cve/CVE-2022-3889/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-3890 page", "url": "https://www.suse.com/security/cve/CVE-2022-3890/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4135 page", "url": "https://www.suse.com/security/cve/CVE-2022-4135/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4174 page", "url": "https://www.suse.com/security/cve/CVE-2022-4174/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4175 page", "url": "https://www.suse.com/security/cve/CVE-2022-4175/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4176 page", "url": "https://www.suse.com/security/cve/CVE-2022-4176/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4177 page", "url": "https://www.suse.com/security/cve/CVE-2022-4177/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4178 page", "url": "https://www.suse.com/security/cve/CVE-2022-4178/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4179 page", "url": "https://www.suse.com/security/cve/CVE-2022-4179/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4180 page", "url": "https://www.suse.com/security/cve/CVE-2022-4180/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4181 page", "url": "https://www.suse.com/security/cve/CVE-2022-4181/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4182 page", "url": "https://www.suse.com/security/cve/CVE-2022-4182/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4183 page", "url": "https://www.suse.com/security/cve/CVE-2022-4183/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4184 page", "url": "https://www.suse.com/security/cve/CVE-2022-4184/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4185 page", "url": "https://www.suse.com/security/cve/CVE-2022-4185/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4186 page", "url": "https://www.suse.com/security/cve/CVE-2022-4186/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4187 page", "url": "https://www.suse.com/security/cve/CVE-2022-4187/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4188 page", "url": "https://www.suse.com/security/cve/CVE-2022-4188/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4189 page", "url": "https://www.suse.com/security/cve/CVE-2022-4189/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4190 page", "url": "https://www.suse.com/security/cve/CVE-2022-4190/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4191 page", "url": "https://www.suse.com/security/cve/CVE-2022-4191/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4192 page", "url": "https://www.suse.com/security/cve/CVE-2022-4192/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4193 page", "url": "https://www.suse.com/security/cve/CVE-2022-4193/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4194 page", "url": "https://www.suse.com/security/cve/CVE-2022-4194/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4195 page", "url": "https://www.suse.com/security/cve/CVE-2022-4195/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4262 page", "url": "https://www.suse.com/security/cve/CVE-2022-4262/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4436 page", "url": "https://www.suse.com/security/cve/CVE-2022-4436/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4437 page", "url": "https://www.suse.com/security/cve/CVE-2022-4437/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4438 page", "url": "https://www.suse.com/security/cve/CVE-2022-4438/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4439 page", "url": "https://www.suse.com/security/cve/CVE-2022-4439/" }, { "category": "self", "summary": "SUSE CVE CVE-2022-4440 page", "url": "https://www.suse.com/security/cve/CVE-2022-4440/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0128 page", "url": "https://www.suse.com/security/cve/CVE-2023-0128/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0129 page", "url": "https://www.suse.com/security/cve/CVE-2023-0129/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0130 page", "url": "https://www.suse.com/security/cve/CVE-2023-0130/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0131 page", "url": "https://www.suse.com/security/cve/CVE-2023-0131/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0132 page", "url": "https://www.suse.com/security/cve/CVE-2023-0132/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0133 page", "url": "https://www.suse.com/security/cve/CVE-2023-0133/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0134 page", "url": "https://www.suse.com/security/cve/CVE-2023-0134/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0135 page", "url": "https://www.suse.com/security/cve/CVE-2023-0135/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0136 page", "url": "https://www.suse.com/security/cve/CVE-2023-0136/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0137 page", "url": "https://www.suse.com/security/cve/CVE-2023-0137/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0138 page", "url": "https://www.suse.com/security/cve/CVE-2023-0138/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0139 page", "url": "https://www.suse.com/security/cve/CVE-2023-0139/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0140 page", "url": "https://www.suse.com/security/cve/CVE-2023-0140/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0141 page", "url": "https://www.suse.com/security/cve/CVE-2023-0141/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0471 page", "url": "https://www.suse.com/security/cve/CVE-2023-0471/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0472 page", "url": "https://www.suse.com/security/cve/CVE-2023-0472/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0473 page", "url": "https://www.suse.com/security/cve/CVE-2023-0473/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0474 page", "url": "https://www.suse.com/security/cve/CVE-2023-0474/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0696 page", "url": "https://www.suse.com/security/cve/CVE-2023-0696/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0697 page", "url": "https://www.suse.com/security/cve/CVE-2023-0697/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0698 page", "url": "https://www.suse.com/security/cve/CVE-2023-0698/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0699 page", "url": "https://www.suse.com/security/cve/CVE-2023-0699/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0700 page", "url": "https://www.suse.com/security/cve/CVE-2023-0700/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0701 page", "url": "https://www.suse.com/security/cve/CVE-2023-0701/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0702 page", "url": "https://www.suse.com/security/cve/CVE-2023-0702/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0703 page", "url": "https://www.suse.com/security/cve/CVE-2023-0703/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0704 page", "url": "https://www.suse.com/security/cve/CVE-2023-0704/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0705 page", "url": "https://www.suse.com/security/cve/CVE-2023-0705/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0927 page", "url": "https://www.suse.com/security/cve/CVE-2023-0927/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0928 page", "url": "https://www.suse.com/security/cve/CVE-2023-0928/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0929 page", "url": "https://www.suse.com/security/cve/CVE-2023-0929/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0930 page", "url": "https://www.suse.com/security/cve/CVE-2023-0930/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0931 page", "url": "https://www.suse.com/security/cve/CVE-2023-0931/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0932 page", "url": "https://www.suse.com/security/cve/CVE-2023-0932/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0933 page", "url": "https://www.suse.com/security/cve/CVE-2023-0933/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-0941 page", "url": "https://www.suse.com/security/cve/CVE-2023-0941/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1213 page", "url": "https://www.suse.com/security/cve/CVE-2023-1213/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1214 page", "url": "https://www.suse.com/security/cve/CVE-2023-1214/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1215 page", "url": "https://www.suse.com/security/cve/CVE-2023-1215/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1216 page", "url": "https://www.suse.com/security/cve/CVE-2023-1216/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1217 page", "url": "https://www.suse.com/security/cve/CVE-2023-1217/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1218 page", "url": "https://www.suse.com/security/cve/CVE-2023-1218/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1219 page", "url": "https://www.suse.com/security/cve/CVE-2023-1219/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1220 page", "url": "https://www.suse.com/security/cve/CVE-2023-1220/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1221 page", "url": "https://www.suse.com/security/cve/CVE-2023-1221/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1222 page", "url": "https://www.suse.com/security/cve/CVE-2023-1222/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1223 page", "url": "https://www.suse.com/security/cve/CVE-2023-1223/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1224 page", "url": "https://www.suse.com/security/cve/CVE-2023-1224/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1225 page", "url": "https://www.suse.com/security/cve/CVE-2023-1225/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1226 page", "url": "https://www.suse.com/security/cve/CVE-2023-1226/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1227 page", "url": "https://www.suse.com/security/cve/CVE-2023-1227/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1228 page", "url": "https://www.suse.com/security/cve/CVE-2023-1228/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1229 page", "url": "https://www.suse.com/security/cve/CVE-2023-1229/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1230 page", "url": "https://www.suse.com/security/cve/CVE-2023-1230/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1231 page", "url": "https://www.suse.com/security/cve/CVE-2023-1231/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1232 page", "url": "https://www.suse.com/security/cve/CVE-2023-1232/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1233 page", "url": "https://www.suse.com/security/cve/CVE-2023-1233/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1234 page", "url": "https://www.suse.com/security/cve/CVE-2023-1234/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1235 page", "url": "https://www.suse.com/security/cve/CVE-2023-1235/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1236 page", "url": "https://www.suse.com/security/cve/CVE-2023-1236/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1528 page", "url": "https://www.suse.com/security/cve/CVE-2023-1528/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1529 page", "url": "https://www.suse.com/security/cve/CVE-2023-1529/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1530 page", "url": "https://www.suse.com/security/cve/CVE-2023-1530/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1531 page", "url": "https://www.suse.com/security/cve/CVE-2023-1531/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1532 page", "url": "https://www.suse.com/security/cve/CVE-2023-1532/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1533 page", "url": "https://www.suse.com/security/cve/CVE-2023-1533/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1534 page", "url": "https://www.suse.com/security/cve/CVE-2023-1534/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1810 page", "url": "https://www.suse.com/security/cve/CVE-2023-1810/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1811 page", "url": "https://www.suse.com/security/cve/CVE-2023-1811/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1812 page", "url": "https://www.suse.com/security/cve/CVE-2023-1812/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1813 page", "url": "https://www.suse.com/security/cve/CVE-2023-1813/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1814 page", "url": "https://www.suse.com/security/cve/CVE-2023-1814/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1815 page", "url": "https://www.suse.com/security/cve/CVE-2023-1815/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1816 page", "url": "https://www.suse.com/security/cve/CVE-2023-1816/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1817 page", "url": "https://www.suse.com/security/cve/CVE-2023-1817/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1818 page", "url": "https://www.suse.com/security/cve/CVE-2023-1818/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1819 page", "url": "https://www.suse.com/security/cve/CVE-2023-1819/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1820 page", "url": "https://www.suse.com/security/cve/CVE-2023-1820/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1821 page", "url": "https://www.suse.com/security/cve/CVE-2023-1821/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1822 page", "url": "https://www.suse.com/security/cve/CVE-2023-1822/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-1823 page", "url": "https://www.suse.com/security/cve/CVE-2023-1823/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2033 page", "url": "https://www.suse.com/security/cve/CVE-2023-2033/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2133 page", "url": "https://www.suse.com/security/cve/CVE-2023-2133/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2134 page", "url": "https://www.suse.com/security/cve/CVE-2023-2134/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2135 page", "url": "https://www.suse.com/security/cve/CVE-2023-2135/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2136 page", "url": "https://www.suse.com/security/cve/CVE-2023-2136/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2137 page", "url": "https://www.suse.com/security/cve/CVE-2023-2137/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2459 page", "url": "https://www.suse.com/security/cve/CVE-2023-2459/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2460 page", "url": "https://www.suse.com/security/cve/CVE-2023-2460/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2461 page", "url": "https://www.suse.com/security/cve/CVE-2023-2461/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2462 page", "url": "https://www.suse.com/security/cve/CVE-2023-2462/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2463 page", "url": "https://www.suse.com/security/cve/CVE-2023-2463/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2464 page", "url": "https://www.suse.com/security/cve/CVE-2023-2464/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2465 page", "url": "https://www.suse.com/security/cve/CVE-2023-2465/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2466 page", "url": "https://www.suse.com/security/cve/CVE-2023-2466/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2467 page", "url": "https://www.suse.com/security/cve/CVE-2023-2467/" }, { "category": "self", "summary": "SUSE CVE CVE-2023-2468 page", "url": "https://www.suse.com/security/cve/CVE-2023-2468/" } ], "title": "ungoogled-chromium-113.0.5672.92-1.1 on GA media", "tracking": { "current_release_date": "2024-06-15T00:00:00Z", "generator": { "date": "2024-06-15T00:00:00Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "openSUSE-SU-2024:12948-1", "initial_release_date": "2024-06-15T00:00:00Z", "revision_history": [ { "date": "2024-06-15T00:00:00Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "ungoogled-chromium-113.0.5672.92-1.1.aarch64", "product": { "name": "ungoogled-chromium-113.0.5672.92-1.1.aarch64", "product_id": "ungoogled-chromium-113.0.5672.92-1.1.aarch64" } }, { "category": "product_version", "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "product": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "product_id": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64" } } ], "category": "architecture", "name": "aarch64" }, { "branches": [ { "category": "product_version", "name": "ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "product": { "name": "ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "product_id": "ungoogled-chromium-113.0.5672.92-1.1.ppc64le" } }, { "category": "product_version", "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "product": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "product_id": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le" } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "ungoogled-chromium-113.0.5672.92-1.1.s390x", "product": { "name": "ungoogled-chromium-113.0.5672.92-1.1.s390x", "product_id": "ungoogled-chromium-113.0.5672.92-1.1.s390x" } }, { "category": "product_version", "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "product": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "product_id": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x" } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "ungoogled-chromium-113.0.5672.92-1.1.x86_64", "product": { "name": "ungoogled-chromium-113.0.5672.92-1.1.x86_64", "product_id": "ungoogled-chromium-113.0.5672.92-1.1.x86_64" } }, { "category": "product_version", "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64", "product": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64", "product_id": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_name", "name": "openSUSE Tumbleweed", "product": { "name": "openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed", "product_identification_helper": { "cpe": "cpe:/o:opensuse:tumbleweed" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-113.0.5672.92-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64" }, "product_reference": "ungoogled-chromium-113.0.5672.92-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-113.0.5672.92-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le" }, "product_reference": "ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-113.0.5672.92-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x" }, "product_reference": "ungoogled-chromium-113.0.5672.92-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-113.0.5672.92-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64" }, "product_reference": "ungoogled-chromium-113.0.5672.92-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64" }, "product_reference": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le" }, "product_reference": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x" }, "product_reference": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "relates_to_product_reference": "openSUSE Tumbleweed" }, { "category": "default_component_of", "full_product_name": { "name": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64 as component of openSUSE Tumbleweed", "product_id": "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" }, "product_reference": "ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64", "relates_to_product_reference": "openSUSE Tumbleweed" } ] }, "vulnerabilities": [ { "cve": "CVE-2011-3015", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3015" } ], "notes": [ { "category": "general", "text": "Multiple integer overflows in the PDF codecs in Google Chrome before 17.0.963.56 allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3015", "url": "https://www.suse.com/security/cve/CVE-2011-3015" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3015", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3015" }, { "cve": "CVE-2011-3016", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3016" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving counter nodes, related to a \"read-after-free\" issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3016", "url": "https://www.suse.com/security/cve/CVE-2011-3016" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3016", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3016" }, { "cve": "CVE-2011-3017", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3017" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to database handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3017", "url": "https://www.suse.com/security/cve/CVE-2011-3017" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3017", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3017" }, { "cve": "CVE-2011-3018", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3018" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to path rendering.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3018", "url": "https://www.suse.com/security/cve/CVE-2011-3018" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3018", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3018" }, { "cve": "CVE-2011-3019", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3019" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Matroska video (aka MKV) file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3019", "url": "https://www.suse.com/security/cve/CVE-2011-3019" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3019", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3019" }, { "cve": "CVE-2011-3020", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3020" } ], "notes": [ { "category": "general", "text": "Unspecified vulnerability in the Native Client validator implementation in Google Chrome before 17.0.963.56 has unknown impact and remote attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3020", "url": "https://www.suse.com/security/cve/CVE-2011-3020" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3020", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3020" }, { "cve": "CVE-2011-3021", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3021" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to subframe loading.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3021", "url": "https://www.suse.com/security/cve/CVE-2011-3021" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3021", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3021" }, { "cve": "CVE-2011-3022", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3022" } ], "notes": [ { "category": "general", "text": "translate/translate_manager.cc in Google Chrome before 17.0.963.56 and 19.x before 19.0.1036.7 uses an HTTP session to exchange data for translation, which allows remote attackers to obtain sensitive information by sniffing the network.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3022", "url": "https://www.suse.com/security/cve/CVE-2011-3022" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3022", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3022" }, { "cve": "CVE-2011-3023", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3023" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.56 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to drag-and-drop operations.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3023", "url": "https://www.suse.com/security/cve/CVE-2011-3023" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3023", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3023" }, { "cve": "CVE-2011-3024", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3024" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.56 allows remote attackers to cause a denial of service (application crash) via an empty X.509 certificate.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3024", "url": "https://www.suse.com/security/cve/CVE-2011-3024" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3024", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3024" }, { "cve": "CVE-2011-3025", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3025" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.56 does not properly parse H.264 data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3025", "url": "https://www.suse.com/security/cve/CVE-2011-3025" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3025", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3025" }, { "cve": "CVE-2011-3026", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3026" } ], "notes": [ { "category": "general", "text": "Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3026", "url": "https://www.suse.com/security/cve/CVE-2011-3026" }, { "category": "external", "summary": "SUSE Bug 747311 for CVE-2011-3026", "url": "https://bugzilla.suse.com/747311" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3026", "url": "https://bugzilla.suse.com/747327" }, { "category": "external", "summary": "SUSE Bug 747328 for CVE-2011-3026", "url": "https://bugzilla.suse.com/747328" }, { "category": "external", "summary": "SUSE Bug 773612 for CVE-2011-3026", "url": "https://bugzilla.suse.com/773612" }, { "category": "external", "summary": "SUSE Bug 854395 for CVE-2011-3026", "url": "https://bugzilla.suse.com/854395" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3026" }, { "cve": "CVE-2011-3027", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3027" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.56 does not properly perform a cast of an unspecified variable during handling of columns, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3027", "url": "https://www.suse.com/security/cve/CVE-2011-3027" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3027", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3027" }, { "cve": "CVE-2011-3031", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3031" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the element wrapper in Google V8, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3031", "url": "https://www.suse.com/security/cve/CVE-2011-3031" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3031", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3031" }, { "cve": "CVE-2011-3032", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3032" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG values.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3032", "url": "https://www.suse.com/security/cve/CVE-2011-3032" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3032", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3032" }, { "cve": "CVE-2011-3033", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3033" } ], "notes": [ { "category": "general", "text": "Buffer overflow in Skia, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3033", "url": "https://www.suse.com/security/cve/CVE-2011-3033" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3033", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3033" }, { "cve": "CVE-2011-3034", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3034" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an SVG document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3034", "url": "https://www.suse.com/security/cve/CVE-2011-3034" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3034", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3034" }, { "cve": "CVE-2011-3035", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3035" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG use elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3035", "url": "https://www.suse.com/security/cve/CVE-2011-3035" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3035", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3035" }, { "cve": "CVE-2011-3036", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3036" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.65 does not properly perform a cast of an unspecified variable during handling of line boxes, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3036", "url": "https://www.suse.com/security/cve/CVE-2011-3036" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3036", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3036" }, { "cve": "CVE-2011-3037", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3037" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.65 does not properly perform casts of unspecified variables during the splitting of anonymous blocks, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3037", "url": "https://www.suse.com/security/cve/CVE-2011-3037" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3037", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3037" }, { "cve": "CVE-2011-3038", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3038" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to multi-column handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3038", "url": "https://www.suse.com/security/cve/CVE-2011-3038" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3038", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3038" }, { "cve": "CVE-2011-3039", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3039" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to quote handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3039", "url": "https://www.suse.com/security/cve/CVE-2011-3039" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3039", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3039" }, { "cve": "CVE-2011-3040", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3040" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.65 does not properly handle text, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3040", "url": "https://www.suse.com/security/cve/CVE-2011-3040" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3040", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3040" }, { "cve": "CVE-2011-3041", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3041" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of class attributes.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3041", "url": "https://www.suse.com/security/cve/CVE-2011-3041" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3041", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3041" }, { "cve": "CVE-2011-3042", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3042" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of table sections.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3042", "url": "https://www.suse.com/security/cve/CVE-2011-3042" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3042", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3042" }, { "cve": "CVE-2011-3043", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3043" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a flexbox (aka flexible box) in conjunction with the floating of elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3043", "url": "https://www.suse.com/security/cve/CVE-2011-3043" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3043", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3043" }, { "cve": "CVE-2011-3044", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3044" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animation elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3044", "url": "https://www.suse.com/security/cve/CVE-2011-3044" }, { "category": "external", "summary": "SUSE Bug 750407 for CVE-2011-3044", "url": "https://bugzilla.suse.com/750407" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3044" }, { "cve": "CVE-2011-3045", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3045" } ], "notes": [ { "category": "general", "text": "Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file, a different vulnerability than CVE-2011-3026.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3045", "url": "https://www.suse.com/security/cve/CVE-2011-3045" }, { "category": "external", "summary": "SUSE Bug 752008 for CVE-2011-3045", "url": "https://bugzilla.suse.com/752008" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3045", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3045" }, { "cve": "CVE-2011-3046", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3046" } ], "notes": [ { "category": "general", "text": "The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a \"Universal XSS (UXSS)\" issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3046", "url": "https://www.suse.com/security/cve/CVE-2011-3046" }, { "category": "external", "summary": "SUSE Bug 751466 for CVE-2011-3046", "url": "https://bugzilla.suse.com/751466" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3046" }, { "cve": "CVE-2011-3047", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3047" } ], "notes": [ { "category": "general", "text": "The GPU process in Google Chrome before 17.0.963.79 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an error in the plug-in loading mechanism.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3047", "url": "https://www.suse.com/security/cve/CVE-2011-3047" }, { "category": "external", "summary": "SUSE Bug 751738 for CVE-2011-3047", "url": "https://bugzilla.suse.com/751738" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3047" }, { "cve": "CVE-2011-3049", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3049" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.83 does not properly restrict the extension web request API, which allows remote attackers to cause a denial of service (disrupted system requests) via a crafted extension.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3049", "url": "https://www.suse.com/security/cve/CVE-2011-3049" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3049", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3049" }, { "cve": "CVE-2011-3050", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3050" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3050", "url": "https://www.suse.com/security/cve/CVE-2011-3050" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3050", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3050" }, { "cve": "CVE-2011-3051", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3051" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the cross-fade function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3051", "url": "https://www.suse.com/security/cve/CVE-2011-3051" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3051", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3051" }, { "cve": "CVE-2011-3052", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3052" } ], "notes": [ { "category": "general", "text": "The WebGL implementation in Google Chrome before 17.0.963.83 does not properly handle CANVAS elements, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3052", "url": "https://www.suse.com/security/cve/CVE-2011-3052" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3052", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3052" }, { "cve": "CVE-2011-3053", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3053" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.83 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to block splitting.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3053", "url": "https://www.suse.com/security/cve/CVE-2011-3053" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3053", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3053" }, { "cve": "CVE-2011-3054", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3054" } ], "notes": [ { "category": "general", "text": "The WebUI privilege implementation in Google Chrome before 17.0.963.83 does not properly perform isolation, which allows remote attackers to bypass intended access restrictions via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3054", "url": "https://www.suse.com/security/cve/CVE-2011-3054" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3054", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3054" }, { "cve": "CVE-2011-3055", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3055" } ], "notes": [ { "category": "general", "text": "The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3055", "url": "https://www.suse.com/security/cve/CVE-2011-3055" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3055", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3055" }, { "cve": "CVE-2011-3056", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3056" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a \"magic iframe.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3056", "url": "https://www.suse.com/security/cve/CVE-2011-3056" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3056", "url": "https://bugzilla.suse.com/754456" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3056" }, { "cve": "CVE-2011-3057", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3057" } ], "notes": [ { "category": "general", "text": "Google V8, as used in Google Chrome before 17.0.963.83, allows remote attackers to cause a denial of service via vectors that trigger an invalid read operation.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3057", "url": "https://www.suse.com/security/cve/CVE-2011-3057" }, { "category": "external", "summary": "SUSE Bug 754456 for CVE-2011-3057", "url": "https://bugzilla.suse.com/754456" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3057", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3057" }, { "cve": "CVE-2011-3058", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3058" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3058", "url": "https://www.suse.com/security/cve/CVE-2011-3058" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3058", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3058" }, { "cve": "CVE-2011-3059", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3059" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.142 does not properly handle SVG text elements, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3059", "url": "https://www.suse.com/security/cve/CVE-2011-3059" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3059", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3059" }, { "cve": "CVE-2011-3060", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3060" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.142 does not properly handle text fragments, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3060", "url": "https://www.suse.com/security/cve/CVE-2011-3060" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3060", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3060" }, { "cve": "CVE-2011-3061", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3061" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.142 does not properly check X.509 certificates before use of a SPDY proxy, which might allow man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3061", "url": "https://www.suse.com/security/cve/CVE-2011-3061" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3061", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3061" }, { "cve": "CVE-2011-3062", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3062" } ], "notes": [ { "category": "general", "text": "Off-by-one error in the OpenType Sanitizer in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted OpenType file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3062", "url": "https://www.suse.com/security/cve/CVE-2011-3062" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3062", "url": "https://bugzilla.suse.com/754458" }, { "category": "external", "summary": "SUSE Bug 758408 for CVE-2011-3062", "url": "https://bugzilla.suse.com/758408" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3062" }, { "cve": "CVE-2011-3063", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3063" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.142 does not properly validate the renderer\u0027s navigation requests, which has unspecified impact and remote attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3063", "url": "https://www.suse.com/security/cve/CVE-2011-3063" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3063", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3063" }, { "cve": "CVE-2011-3064", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3064" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.142 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG clipping.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3064", "url": "https://www.suse.com/security/cve/CVE-2011-3064" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3064", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3064" }, { "cve": "CVE-2011-3065", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3065" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 18.0.1025.142, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3065", "url": "https://www.suse.com/security/cve/CVE-2011-3065" }, { "category": "external", "summary": "SUSE Bug 754458 for CVE-2011-3065", "url": "https://bugzilla.suse.com/754458" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3065" }, { "cve": "CVE-2011-3066", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3066" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 18.0.1025.151, does not properly perform clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3066", "url": "https://www.suse.com/security/cve/CVE-2011-3066" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3066" }, { "cve": "CVE-2011-3067", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3067" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to replacement of IFRAME elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3067", "url": "https://www.suse.com/security/cve/CVE-2011-3067" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3067" }, { "cve": "CVE-2011-3068", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3068" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to run-in boxes.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3068", "url": "https://www.suse.com/security/cve/CVE-2011-3068" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3068" }, { "cve": "CVE-2011-3069", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3069" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to line boxes.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3069", "url": "https://www.suse.com/security/cve/CVE-2011-3069" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3069" }, { "cve": "CVE-2011-3070", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3070" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Google V8 bindings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3070", "url": "https://www.suse.com/security/cve/CVE-2011-3070" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3070" }, { "cve": "CVE-2011-3071", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3071" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the HTMLMediaElement implementation in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3071", "url": "https://www.suse.com/security/cve/CVE-2011-3071" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3071" }, { "cve": "CVE-2011-3072", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3072" } ], "notes": [ { "category": "general", "text": "Google Chrome before 18.0.1025.151 allows remote attackers to bypass the Same Origin Policy via vectors related to pop-up windows.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3072", "url": "https://www.suse.com/security/cve/CVE-2011-3072" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3072" }, { "cve": "CVE-2011-3073", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3073" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG resources.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3073", "url": "https://www.suse.com/security/cve/CVE-2011-3073" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3073" }, { "cve": "CVE-2011-3074", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3074" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3074", "url": "https://www.suse.com/security/cve/CVE-2011-3074" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3074" }, { "cve": "CVE-2011-3075", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3075" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style-application commands.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3075", "url": "https://www.suse.com/security/cve/CVE-2011-3075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3075" }, { "cve": "CVE-2011-3076", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3076" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to focus handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3076", "url": "https://www.suse.com/security/cve/CVE-2011-3076" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3076" }, { "cve": "CVE-2011-3077", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3077" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.151 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the script bindings, related to a \"read-after-free\" issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3077", "url": "https://www.suse.com/security/cve/CVE-2011-3077" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3077" }, { "cve": "CVE-2011-3078", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3078" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3081.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3078", "url": "https://www.suse.com/security/cve/CVE-2011-3078" }, { "category": "external", "summary": "SUSE Bug 760264 for CVE-2011-3078", "url": "https://bugzilla.suse.com/760264" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3078" }, { "cve": "CVE-2011-3079", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3079" } ], "notes": [ { "category": "general", "text": "The Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168, as used in Mozilla Firefox before 38.0 and other products, does not properly validate messages, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3079", "url": "https://www.suse.com/security/cve/CVE-2011-3079" }, { "category": "external", "summary": "SUSE Bug 1122983 for CVE-2011-3079", "url": "https://bugzilla.suse.com/1122983" }, { "category": "external", "summary": "SUSE Bug 760264 for CVE-2011-3079", "url": "https://bugzilla.suse.com/760264" }, { "category": "external", "summary": "SUSE Bug 930622 for CVE-2011-3079", "url": "https://bugzilla.suse.com/930622" }, { "category": "external", "summary": "SUSE Bug 986639 for CVE-2011-3079", "url": "https://bugzilla.suse.com/986639" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3079" }, { "cve": "CVE-2011-3080", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3080" } ], "notes": [ { "category": "general", "text": "Race condition in the Inter-process Communication (IPC) implementation in Google Chrome before 18.0.1025.168 allows attackers to bypass intended sandbox restrictions via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3080", "url": "https://www.suse.com/security/cve/CVE-2011-3080" }, { "category": "external", "summary": "SUSE Bug 760264 for CVE-2011-3080", "url": "https://bugzilla.suse.com/760264" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3080" }, { "cve": "CVE-2011-3081", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3081" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3078.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3081", "url": "https://www.suse.com/security/cve/CVE-2011-3081" }, { "category": "external", "summary": "SUSE Bug 760264 for CVE-2011-3081", "url": "https://bugzilla.suse.com/760264" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3081" }, { "cve": "CVE-2011-3083", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3083" } ], "notes": [ { "category": "general", "text": "browser/profiles/profile_impl_io_data.cc in Google Chrome before 19.0.1084.46 does not properly handle a malformed ftp URL in the SRC attribute of a VIDEO element, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted web page.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3083", "url": "https://www.suse.com/security/cve/CVE-2011-3083" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3083", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3083" }, { "cve": "CVE-2011-3084", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3084" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not use a dedicated process for the loading of links found on an internal page, which might allow attackers to bypass intended sandbox restrictions via a crafted page.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3084", "url": "https://www.suse.com/security/cve/CVE-2011-3084" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3084", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3084" }, { "cve": "CVE-2011-3085", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3085" } ], "notes": [ { "category": "general", "text": "The Autofill feature in Google Chrome before 19.0.1084.46 does not properly restrict field values, which allows remote attackers to cause a denial of service (UI corruption) and possibly conduct spoofing attacks via vectors involving long values.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3085", "url": "https://www.suse.com/security/cve/CVE-2011-3085" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3085", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3085" }, { "cve": "CVE-2011-3086", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3086" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a STYLE element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3086", "url": "https://www.suse.com/security/cve/CVE-2011-3086" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3086", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3086" }, { "cve": "CVE-2011-3087", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3087" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not properly perform window navigation, which has unspecified impact and remote attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3087", "url": "https://www.suse.com/security/cve/CVE-2011-3087" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3087", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3087" }, { "cve": "CVE-2011-3088", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3088" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not properly draw hairlines, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3088", "url": "https://www.suse.com/security/cve/CVE-2011-3088" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3088", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3088" }, { "cve": "CVE-2011-3089", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3089" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving tables.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3089", "url": "https://www.suse.com/security/cve/CVE-2011-3089" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3089", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3089" }, { "cve": "CVE-2011-3090", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3090" } ], "notes": [ { "category": "general", "text": "Race condition in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker processes.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3090", "url": "https://www.suse.com/security/cve/CVE-2011-3090" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3090", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3090" }, { "cve": "CVE-2011-3091", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3091" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the IndexedDB implementation in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3091", "url": "https://www.suse.com/security/cve/CVE-2011-3091" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3091", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3091" }, { "cve": "CVE-2011-3092", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3092" } ], "notes": [ { "category": "general", "text": "The regex implementation in Google V8, as used in Google Chrome before 19.0.1084.46, allows remote attackers to cause a denial of service (invalid write operation) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3092", "url": "https://www.suse.com/security/cve/CVE-2011-3092" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3092", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3092" }, { "cve": "CVE-2011-3093", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3093" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not properly handle glyphs, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3093", "url": "https://www.suse.com/security/cve/CVE-2011-3093" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3093", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3093" }, { "cve": "CVE-2011-3094", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3094" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not properly handle Tibetan text, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3094", "url": "https://www.suse.com/security/cve/CVE-2011-3094" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3094", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3094" }, { "cve": "CVE-2011-3095", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3095" } ], "notes": [ { "category": "general", "text": "The OGG container in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3095", "url": "https://www.suse.com/security/cve/CVE-2011-3095" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3095", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3095" }, { "cve": "CVE-2011-3096", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3096" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 19.0.1084.46 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an error in the GTK implementation of the omnibox.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3096", "url": "https://www.suse.com/security/cve/CVE-2011-3096" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3096", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3096" }, { "cve": "CVE-2011-3098", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3098" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 on Windows uses an incorrect search path for the Windows Media Player plug-in, which might allow local users to gain privileges via a Trojan horse plug-in in an unspecified directory.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3098", "url": "https://www.suse.com/security/cve/CVE-2011-3098" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3098", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3098" }, { "cve": "CVE-2011-3100", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3100" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 does not properly draw dash paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3100", "url": "https://www.suse.com/security/cve/CVE-2011-3100" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3100", "url": "https://bugzilla.suse.com/762481" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3100" }, { "cve": "CVE-2011-3101", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3101" } ], "notes": [ { "category": "general", "text": "Google Chrome before 19.0.1084.46 on Linux does not properly mitigate an unspecified flaw in an NVIDIA driver, which has unknown impact and attack vectors. NOTE: see CVE-2012-3105 for the related MFSA 2012-34 issue in Mozilla products.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3101", "url": "https://www.suse.com/security/cve/CVE-2011-3101" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3101", "url": "https://bugzilla.suse.com/762481" }, { "category": "external", "summary": "SUSE Bug 765204 for CVE-2011-3101", "url": "https://bugzilla.suse.com/765204" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3101" }, { "cve": "CVE-2011-3102", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3102" } ], "notes": [ { "category": "general", "text": "Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3102", "url": "https://www.suse.com/security/cve/CVE-2011-3102" }, { "category": "external", "summary": "SUSE Bug 1123919 for CVE-2011-3102", "url": "https://bugzilla.suse.com/1123919" }, { "category": "external", "summary": "SUSE Bug 762481 for CVE-2011-3102", "url": "https://bugzilla.suse.com/762481" }, { "category": "external", "summary": "SUSE Bug 764538 for CVE-2011-3102", "url": "https://bugzilla.suse.com/764538" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3102" }, { "cve": "CVE-2011-3903", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3903" } ], "notes": [ { "category": "general", "text": "Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3903", "url": "https://www.suse.com/security/cve/CVE-2011-3903" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3903", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3903" }, { "cve": "CVE-2011-3904", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3904" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to bidirectional text (aka bidi) handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3904", "url": "https://www.suse.com/security/cve/CVE-2011-3904" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3904", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3904" }, { "cve": "CVE-2011-3905", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3905" } ], "notes": [ { "category": "general", "text": "libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3905", "url": "https://www.suse.com/security/cve/CVE-2011-3905" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3905", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3905" }, { "cve": "CVE-2011-3906", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3906" } ], "notes": [ { "category": "general", "text": "The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3906", "url": "https://www.suse.com/security/cve/CVE-2011-3906" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3906", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3906" }, { "cve": "CVE-2011-3907", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3907" } ], "notes": [ { "category": "general", "text": "The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3907", "url": "https://www.suse.com/security/cve/CVE-2011-3907" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3907", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3907" }, { "cve": "CVE-2011-3908", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3908" } ], "notes": [ { "category": "general", "text": "Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3908", "url": "https://www.suse.com/security/cve/CVE-2011-3908" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3908", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3908" }, { "cve": "CVE-2011-3909", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3909" } ], "notes": [ { "category": "general", "text": "The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3909", "url": "https://www.suse.com/security/cve/CVE-2011-3909" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3909", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3909" }, { "cve": "CVE-2011-3910", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3910" } ], "notes": [ { "category": "general", "text": "Google Chrome before 16.0.912.63 does not properly handle YUV video frames, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3910", "url": "https://www.suse.com/security/cve/CVE-2011-3910" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3910", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3910" }, { "cve": "CVE-2011-3911", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3911" } ], "notes": [ { "category": "general", "text": "Google Chrome before 16.0.912.63 does not properly handle PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3911", "url": "https://www.suse.com/security/cve/CVE-2011-3911" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3911", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3911" }, { "cve": "CVE-2011-3912", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3912" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3912", "url": "https://www.suse.com/security/cve/CVE-2011-3912" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3912", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3912" }, { "cve": "CVE-2011-3914", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3914" } ], "notes": [ { "category": "general", "text": "The internationalization (aka i18n) functionality in Google V8, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3914", "url": "https://www.suse.com/security/cve/CVE-2011-3914" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3914", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3914" }, { "cve": "CVE-2011-3915", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3915" } ], "notes": [ { "category": "general", "text": "Buffer overflow in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF fonts.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3915", "url": "https://www.suse.com/security/cve/CVE-2011-3915" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3915", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3915" }, { "cve": "CVE-2011-3916", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3916" } ], "notes": [ { "category": "general", "text": "Google Chrome before 16.0.912.63 does not properly handle PDF cross references, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3916", "url": "https://www.suse.com/security/cve/CVE-2011-3916" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3916", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3916" }, { "cve": "CVE-2011-3917", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3917" } ], "notes": [ { "category": "general", "text": "Stack-based buffer overflow in FileWatcher in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3917", "url": "https://www.suse.com/security/cve/CVE-2011-3917" }, { "category": "external", "summary": "SUSE Bug 736716 for CVE-2011-3917", "url": "https://bugzilla.suse.com/736716" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3917" }, { "cve": "CVE-2011-3919", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3919" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3919", "url": "https://www.suse.com/security/cve/CVE-2011-3919" }, { "category": "external", "summary": "SUSE Bug 1123919 for CVE-2011-3919", "url": "https://bugzilla.suse.com/1123919" }, { "category": "external", "summary": "SUSE Bug 739894 for CVE-2011-3919", "url": "https://bugzilla.suse.com/739894" }, { "category": "external", "summary": "SUSE Bug 740493 for CVE-2011-3919", "url": "https://bugzilla.suse.com/740493" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3919" }, { "cve": "CVE-2011-3921", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3921" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving animation frames.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3921", "url": "https://www.suse.com/security/cve/CVE-2011-3921" }, { "category": "external", "summary": "SUSE Bug 740493 for CVE-2011-3921", "url": "https://bugzilla.suse.com/740493" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3921" }, { "cve": "CVE-2011-3922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3922" } ], "notes": [ { "category": "general", "text": "Stack-based buffer overflow in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to glyph handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3922", "url": "https://www.suse.com/security/cve/CVE-2011-3922" }, { "category": "external", "summary": "SUSE Bug 739904 for CVE-2011-3922", "url": "https://bugzilla.suse.com/739904" }, { "category": "external", "summary": "SUSE Bug 740493 for CVE-2011-3922", "url": "https://bugzilla.suse.com/740493" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3922" }, { "cve": "CVE-2011-3924", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3924" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM selections.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3924", "url": "https://www.suse.com/security/cve/CVE-2011-3924" }, { "category": "external", "summary": "SUSE Bug 743319 for CVE-2011-3924", "url": "https://bugzilla.suse.com/743319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3924" }, { "cve": "CVE-2011-3925", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3925" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Safe Browsing feature in Google Chrome before 16.0.912.75 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors related to a navigation entry and an interstitial page.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3925", "url": "https://www.suse.com/security/cve/CVE-2011-3925" }, { "category": "external", "summary": "SUSE Bug 743319 for CVE-2011-3925", "url": "https://bugzilla.suse.com/743319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3925" }, { "cve": "CVE-2011-3926", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3926" } ], "notes": [ { "category": "general", "text": "Heap-based buffer overflow in the tree builder in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3926", "url": "https://www.suse.com/security/cve/CVE-2011-3926" }, { "category": "external", "summary": "SUSE Bug 743319 for CVE-2011-3926", "url": "https://bugzilla.suse.com/743319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3926" }, { "cve": "CVE-2011-3927", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3927" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 16.0.912.77, does not perform all required initialization of values, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3927", "url": "https://www.suse.com/security/cve/CVE-2011-3927" }, { "category": "external", "summary": "SUSE Bug 743319 for CVE-2011-3927", "url": "https://bugzilla.suse.com/743319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3927" }, { "cve": "CVE-2011-3928", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3928" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 16.0.912.77 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3928", "url": "https://www.suse.com/security/cve/CVE-2011-3928" }, { "category": "external", "summary": "SUSE Bug 743319 for CVE-2011-3928", "url": "https://bugzilla.suse.com/743319" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3928" }, { "cve": "CVE-2011-3953", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3953" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not prevent monitoring of the clipboard after a paste event, which has unspecified impact and remote attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3953", "url": "https://www.suse.com/security/cve/CVE-2011-3953" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3953", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3953" }, { "cve": "CVE-2011-3954", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3954" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via vectors that trigger a large amount of database usage.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3954", "url": "https://www.suse.com/security/cve/CVE-2011-3954" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3954", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3954" }, { "cve": "CVE-2011-3955", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3955" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that trigger the aborting of an IndexedDB transaction.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3955", "url": "https://www.suse.com/security/cve/CVE-2011-3955" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3955", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3955" }, { "cve": "CVE-2011-3956", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3956" } ], "notes": [ { "category": "general", "text": "The extension implementation in Google Chrome before 17.0.963.46 does not properly handle sandboxed origins, which might allow remote attackers to bypass the Same Origin Policy via a crafted extension.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3956", "url": "https://www.suse.com/security/cve/CVE-2011-3956" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3956", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3956" }, { "cve": "CVE-2011-3957", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3957" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the garbage-collection functionality in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving PDF documents.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3957", "url": "https://www.suse.com/security/cve/CVE-2011-3957" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3957", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3957" }, { "cve": "CVE-2011-3958", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3958" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly perform casts of variables during handling of a column span, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3958", "url": "https://www.suse.com/security/cve/CVE-2011-3958" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3958", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3958" }, { "cve": "CVE-2011-3959", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3959" } ], "notes": [ { "category": "general", "text": "Buffer overflow in the locale implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3959", "url": "https://www.suse.com/security/cve/CVE-2011-3959" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3959", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3959" }, { "cve": "CVE-2011-3960", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3960" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly decode audio data, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3960", "url": "https://www.suse.com/security/cve/CVE-2011-3960" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3960", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3960" }, { "cve": "CVE-2011-3961", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3961" } ], "notes": [ { "category": "general", "text": "Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3961", "url": "https://www.suse.com/security/cve/CVE-2011-3961" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3961", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2011-3961" }, { "cve": "CVE-2011-3962", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3962" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly perform path clipping, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3962", "url": "https://www.suse.com/security/cve/CVE-2011-3962" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3962", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3962" }, { "cve": "CVE-2011-3963", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3963" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly handle PDF FAX images, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3963", "url": "https://www.suse.com/security/cve/CVE-2011-3963" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3963", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3963" }, { "cve": "CVE-2011-3964", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3964" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly implement the drag-and-drop feature, which makes it easier for remote attackers to spoof the URL bar via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3964", "url": "https://www.suse.com/security/cve/CVE-2011-3964" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3964", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3964" }, { "cve": "CVE-2011-3965", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3965" } ], "notes": [ { "category": "general", "text": "Google Chrome before 17.0.963.46 does not properly check signatures, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3965", "url": "https://www.suse.com/security/cve/CVE-2011-3965" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3965", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3965" }, { "cve": "CVE-2011-3966", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3966" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to error handling for Cascading Style Sheets (CSS) token-sequence data.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3966", "url": "https://www.suse.com/security/cve/CVE-2011-3966" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3966", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2011-3966" }, { "cve": "CVE-2011-3967", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3967" } ], "notes": [ { "category": "general", "text": "Unspecified vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (application crash) via a crafted certificate.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3967", "url": "https://www.suse.com/security/cve/CVE-2011-3967" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3967", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3967" }, { "cve": "CVE-2011-3968", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3968" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving Cascading Style Sheets (CSS) token sequences.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3968", "url": "https://www.suse.com/security/cve/CVE-2011-3968" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3968", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3968" }, { "cve": "CVE-2011-3969", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3969" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout of SVG documents.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3969", "url": "https://www.suse.com/security/cve/CVE-2011-3969" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3969", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3969" }, { "cve": "CVE-2011-3970", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3970" } ], "notes": [ { "category": "general", "text": "libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3970", "url": "https://www.suse.com/security/cve/CVE-2011-3970" }, { "category": "external", "summary": "SUSE Bug 746039 for CVE-2011-3970", "url": "https://bugzilla.suse.com/746039" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3970", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3970" }, { "cve": "CVE-2011-3971", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3971" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 17.0.963.46 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to mousemove events.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3971", "url": "https://www.suse.com/security/cve/CVE-2011-3971" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3971", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3971" }, { "cve": "CVE-2011-3972", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2011-3972" } ], "notes": [ { "category": "general", "text": "The shader translator implementation in Google Chrome before 17.0.963.46 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2011-3972", "url": "https://www.suse.com/security/cve/CVE-2011-3972" }, { "category": "external", "summary": "SUSE Bug 747327 for CVE-2011-3972", "url": "https://bugzilla.suse.com/747327" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2011-3972" }, { "cve": "CVE-2012-1521", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-1521" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-1521", "url": "https://www.suse.com/security/cve/CVE-2012-1521" }, { "category": "external", "summary": "SUSE Bug 760264 for CVE-2012-1521", "url": "https://bugzilla.suse.com/760264" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-1521" }, { "cve": "CVE-2012-2807", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2807" } ], "notes": [ { "category": "general", "text": "Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2807", "url": "https://www.suse.com/security/cve/CVE-2012-2807" }, { "category": "external", "summary": "SUSE Bug 1123919 for CVE-2012-2807", "url": "https://bugzilla.suse.com/1123919" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2807", "url": "https://bugzilla.suse.com/769181" }, { "category": "external", "summary": "SUSE Bug 769184 for CVE-2012-2807", "url": "https://bugzilla.suse.com/769184" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2807" }, { "cve": "CVE-2012-2815", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2815" } ], "notes": [ { "category": "general", "text": "Google Chrome before 20.0.1132.43 allows remote attackers to obtain potentially sensitive information from a fragment identifier by leveraging access to an IFRAME element associated with a different domain.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2815", "url": "https://www.suse.com/security/cve/CVE-2012-2815" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2815", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2815" }, { "cve": "CVE-2012-2816", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2816" } ], "notes": [ { "category": "general", "text": "Google Chrome before 20.0.1132.43 on Windows does not properly isolate sandboxed processes, which might allow remote attackers to cause a denial of service (process interference) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2816", "url": "https://www.suse.com/security/cve/CVE-2012-2816" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2816", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2816" }, { "cve": "CVE-2012-2817", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2817" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to tables that have sections.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2817", "url": "https://www.suse.com/security/cve/CVE-2012-2817" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2817", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2817" }, { "cve": "CVE-2012-2818", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2818" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the layout of documents that use the Cascading Style Sheets (CSS) counters feature.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2818", "url": "https://www.suse.com/security/cve/CVE-2012-2818" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2818", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2818" }, { "cve": "CVE-2012-2819", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2819" } ], "notes": [ { "category": "general", "text": "The texSubImage2D implementation in the WebGL subsystem in Google Chrome before 20.0.1132.43 does not properly handle uploads to floating-point textures, which allows remote attackers to cause a denial of service (assertion failure and application crash) or possibly have unspecified other impact via a crafted web page, as demonstrated by certain WebGL performance tests, aka rdar problem 11520387.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2819", "url": "https://www.suse.com/security/cve/CVE-2012-2819" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2819", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2819" }, { "cve": "CVE-2012-2820", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2820" } ], "notes": [ { "category": "general", "text": "Google Chrome before 20.0.1132.43 does not properly implement SVG filters, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2820", "url": "https://www.suse.com/security/cve/CVE-2012-2820" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2820", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2820" }, { "cve": "CVE-2012-2821", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2821" } ], "notes": [ { "category": "general", "text": "The autofill implementation in Google Chrome before 20.0.1132.43 does not properly display text, which has unspecified impact and remote attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2821", "url": "https://www.suse.com/security/cve/CVE-2012-2821" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2821", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2821" }, { "cve": "CVE-2012-2823", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2823" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG resources.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2823", "url": "https://www.suse.com/security/cve/CVE-2012-2823" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2823", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2823" }, { "cve": "CVE-2012-2825", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2825" } ], "notes": [ { "category": "general", "text": "The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2825", "url": "https://www.suse.com/security/cve/CVE-2012-2825" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2825", "url": "https://bugzilla.suse.com/769181" }, { "category": "external", "summary": "SUSE Bug 769182 for CVE-2012-2825", "url": "https://bugzilla.suse.com/769182" }, { "category": "external", "summary": "SUSE Bug 849019 for CVE-2012-2825", "url": "https://bugzilla.suse.com/849019" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2825" }, { "cve": "CVE-2012-2826", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2826" } ], "notes": [ { "category": "general", "text": "Google Chrome before 20.0.1132.43 does not properly implement texture conversion, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2826", "url": "https://www.suse.com/security/cve/CVE-2012-2826" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2826", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2826" }, { "cve": "CVE-2012-2829", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2829" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the :first-letter pseudo-element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2829", "url": "https://www.suse.com/security/cve/CVE-2012-2829" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2829", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2829" }, { "cve": "CVE-2012-2830", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2830" } ], "notes": [ { "category": "general", "text": "Google Chrome before 20.0.1132.43 does not properly set array values, which allows remote attackers to cause a denial of service (incorrect pointer use) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2830", "url": "https://www.suse.com/security/cve/CVE-2012-2830" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2830", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2830" }, { "cve": "CVE-2012-2831", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2831" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG references.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2831", "url": "https://www.suse.com/security/cve/CVE-2012-2831" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2831", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2831" }, { "cve": "CVE-2012-2834", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2834" } ], "notes": [ { "category": "general", "text": "Integer overflow in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted data in the Matroska container format.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2834", "url": "https://www.suse.com/security/cve/CVE-2012-2834" }, { "category": "external", "summary": "SUSE Bug 769181 for CVE-2012-2834", "url": "https://bugzilla.suse.com/769181" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-2834" }, { "cve": "CVE-2012-2842", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2842" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to counter handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2842", "url": "https://www.suse.com/security/cve/CVE-2012-2842" }, { "category": "external", "summary": "SUSE Bug 770821 for CVE-2012-2842", "url": "https://bugzilla.suse.com/770821" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2842" }, { "cve": "CVE-2012-2843", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2843" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 20.0.1132.57 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to layout height tracking.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2843", "url": "https://www.suse.com/security/cve/CVE-2012-2843" }, { "category": "external", "summary": "SUSE Bug 770821 for CVE-2012-2843", "url": "https://bugzilla.suse.com/770821" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2843" }, { "cve": "CVE-2012-2865", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2865" } ], "notes": [ { "category": "general", "text": "Google Chrome before 21.0.1180.89 does not properly perform line breaking, which allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2865", "url": "https://www.suse.com/security/cve/CVE-2012-2865" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2865", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2865" }, { "cve": "CVE-2012-2866", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2866" } ], "notes": [ { "category": "general", "text": "Google Chrome before 21.0.1180.89 does not properly perform a cast of an unspecified variable during handling of run-in elements, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2866", "url": "https://www.suse.com/security/cve/CVE-2012-2866" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2866", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2866" }, { "cve": "CVE-2012-2867", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2867" } ], "notes": [ { "category": "general", "text": "The SPDY implementation in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2867", "url": "https://www.suse.com/security/cve/CVE-2012-2867" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2867", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2867" }, { "cve": "CVE-2012-2868", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2868" } ], "notes": [ { "category": "general", "text": "Race condition in Google Chrome before 21.0.1180.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving improper interaction between worker processes and an XMLHttpRequest (aka XHR) object.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2868", "url": "https://www.suse.com/security/cve/CVE-2012-2868" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2868", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2868" }, { "cve": "CVE-2012-2869", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2869" } ], "notes": [ { "category": "general", "text": "Google Chrome before 21.0.1180.89 does not properly load URLs, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a \"stale buffer.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2869", "url": "https://www.suse.com/security/cve/CVE-2012-2869" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2869", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2869" }, { "cve": "CVE-2012-2870", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2870" } ], "notes": [ { "category": "general", "text": "libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2870", "url": "https://www.suse.com/security/cve/CVE-2012-2870" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2870", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2870" }, { "cve": "CVE-2012-2871", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2871" } ], "notes": [ { "category": "general", "text": "libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2871", "url": "https://www.suse.com/security/cve/CVE-2012-2871" }, { "category": "external", "summary": "SUSE Bug 1078828 for CVE-2012-2871", "url": "https://bugzilla.suse.com/1078828" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2871", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2871" }, { "cve": "CVE-2012-2872", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2872" } ], "notes": [ { "category": "general", "text": "Cross-site scripting (XSS) vulnerability in an SSL interstitial page in Google Chrome before 21.0.1180.89 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2872", "url": "https://www.suse.com/security/cve/CVE-2012-2872" }, { "category": "external", "summary": "SUSE Bug 778005 for CVE-2012-2872", "url": "https://bugzilla.suse.com/778005" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2872" }, { "cve": "CVE-2012-2874", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2874" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2883.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2874", "url": "https://www.suse.com/security/cve/CVE-2012-2874" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2874", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2874" }, { "cve": "CVE-2012-2876", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2876" } ], "notes": [ { "category": "general", "text": "Buffer overflow in the SSE2 optimization functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2876", "url": "https://www.suse.com/security/cve/CVE-2012-2876" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2876", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2876" }, { "cve": "CVE-2012-2877", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2877" } ], "notes": [ { "category": "general", "text": "The extension system in Google Chrome before 22.0.1229.79 does not properly handle modal dialogs, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2877", "url": "https://www.suse.com/security/cve/CVE-2012-2877" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2877", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2877" }, { "cve": "CVE-2012-2878", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2878" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to plug-in handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2878", "url": "https://www.suse.com/security/cve/CVE-2012-2878" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2878", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2878" }, { "cve": "CVE-2012-2879", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2879" } ], "notes": [ { "category": "general", "text": "Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service (DOM topology corruption) via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2879", "url": "https://www.suse.com/security/cve/CVE-2012-2879" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2879", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2879" }, { "cve": "CVE-2012-2880", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2880" } ], "notes": [ { "category": "general", "text": "Race condition in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the plug-in paint buffer.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2880", "url": "https://www.suse.com/security/cve/CVE-2012-2880" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2880", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2880" }, { "cve": "CVE-2012-2881", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2881" } ], "notes": [ { "category": "general", "text": "Google Chrome before 22.0.1229.79 does not properly handle plug-ins, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2881", "url": "https://www.suse.com/security/cve/CVE-2012-2881" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2881", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2881" }, { "cve": "CVE-2012-2882", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2882" } ], "notes": [ { "category": "general", "text": "FFmpeg, as used in Google Chrome before 22.0.1229.79, does not properly handle OGG containers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a \"wild pointer\" issue.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2882", "url": "https://www.suse.com/security/cve/CVE-2012-2882" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2882", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2882" }, { "cve": "CVE-2012-2883", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2883" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation, a different vulnerability than CVE-2012-2874.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2883", "url": "https://www.suse.com/security/cve/CVE-2012-2883" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2883", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2883" }, { "cve": "CVE-2012-2884", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2884" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2884", "url": "https://www.suse.com/security/cve/CVE-2012-2884" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2884", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2884" }, { "cve": "CVE-2012-2885", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2885" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to application exit.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2885", "url": "https://www.suse.com/security/cve/CVE-2012-2885" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2885", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2885" }, { "cve": "CVE-2012-2886", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2886" } ], "notes": [ { "category": "general", "text": "Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors related to the Google V8 bindings, aka \"Universal XSS (UXSS).\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2886", "url": "https://www.suse.com/security/cve/CVE-2012-2886" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2886", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2886" }, { "cve": "CVE-2012-2887", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2887" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving onclick events.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2887", "url": "https://www.suse.com/security/cve/CVE-2012-2887" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2887", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2887" }, { "cve": "CVE-2012-2888", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2888" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG text references.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2888", "url": "https://www.suse.com/security/cve/CVE-2012-2888" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2888", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2888" }, { "cve": "CVE-2012-2889", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2889" } ], "notes": [ { "category": "general", "text": "Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka \"Universal XSS (UXSS).\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2889", "url": "https://www.suse.com/security/cve/CVE-2012-2889" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2889", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2889" }, { "cve": "CVE-2012-2891", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2891" } ], "notes": [ { "category": "general", "text": "The IPC implementation in Google Chrome before 22.0.1229.79 allows attackers to obtain potentially sensitive information about memory addresses via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2891", "url": "https://www.suse.com/security/cve/CVE-2012-2891" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2891", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2891" }, { "cve": "CVE-2012-2892", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2892" } ], "notes": [ { "category": "general", "text": "Unspecified vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to bypass the pop-up blocker via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2892", "url": "https://www.suse.com/security/cve/CVE-2012-2892" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2892", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2892" }, { "cve": "CVE-2012-2893", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2893" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2893", "url": "https://www.suse.com/security/cve/CVE-2012-2893" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2893", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2893" }, { "cve": "CVE-2012-2894", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2894" } ], "notes": [ { "category": "general", "text": "Google Chrome before 22.0.1229.79 does not properly handle graphics-context data structures, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2894", "url": "https://www.suse.com/security/cve/CVE-2012-2894" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2894", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-2894" }, { "cve": "CVE-2012-2896", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-2896" } ], "notes": [ { "category": "general", "text": "Integer overflow in the WebGL implementation in Google Chrome before 22.0.1229.79 on Mac OS X allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-2896", "url": "https://www.suse.com/security/cve/CVE-2012-2896" }, { "category": "external", "summary": "SUSE Bug 782257 for CVE-2012-2896", "url": "https://bugzilla.suse.com/782257" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-2896" }, { "cve": "CVE-2012-5130", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5130" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 23.0.1271.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5130", "url": "https://www.suse.com/security/cve/CVE-2012-5130" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5130", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5130" }, { "cve": "CVE-2012-5131", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5131" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.91 on Mac OS X does not properly mitigate improper rendering behavior in the Intel GPU driver, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5131", "url": "https://www.suse.com/security/cve/CVE-2012-5131" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5131", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5131" }, { "cve": "CVE-2012-5132", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5132" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service (application crash) via a response with chunked transfer coding.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5132", "url": "https://www.suse.com/security/cve/CVE-2012-5132" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5132", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5132" }, { "cve": "CVE-2012-5133", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5133" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG filters.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5133", "url": "https://www.suse.com/security/cve/CVE-2012-5133" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5133", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5133" }, { "cve": "CVE-2012-5134", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5134" } ], "notes": [ { "category": "general", "text": "Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5134", "url": "https://www.suse.com/security/cve/CVE-2012-5134" }, { "category": "external", "summary": "SUSE Bug 1123919 for CVE-2012-5134", "url": "https://bugzilla.suse.com/1123919" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5134", "url": "https://bugzilla.suse.com/791234" }, { "category": "external", "summary": "SUSE Bug 793334 for CVE-2012-5134", "url": "https://bugzilla.suse.com/793334" }, { "category": "external", "summary": "SUSE Bug 795039 for CVE-2012-5134", "url": "https://bugzilla.suse.com/795039" }, { "category": "external", "summary": "SUSE Bug 804033 for CVE-2012-5134", "url": "https://bugzilla.suse.com/804033" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5134" }, { "cve": "CVE-2012-5135", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5135" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 23.0.1271.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5135", "url": "https://www.suse.com/security/cve/CVE-2012-5135" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5135", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5135" }, { "cve": "CVE-2012-5136", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5136" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.91 does not properly perform a cast of an unspecified variable during handling of the INPUT element, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted HTML document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5136", "url": "https://www.suse.com/security/cve/CVE-2012-5136" }, { "category": "external", "summary": "SUSE Bug 791234 for CVE-2012-5136", "url": "https://bugzilla.suse.com/791234" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5136" }, { "cve": "CVE-2012-5137", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5137" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 23.0.1271.95 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the Media Source API.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5137", "url": "https://www.suse.com/security/cve/CVE-2012-5137" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5137" }, { "cve": "CVE-2012-5138", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5138" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.95 does not properly handle file paths, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5138", "url": "https://www.suse.com/security/cve/CVE-2012-5138" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5138" }, { "cve": "CVE-2012-5139", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5139" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to visibility events.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5139", "url": "https://www.suse.com/security/cve/CVE-2012-5139" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5139", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5139" }, { "cve": "CVE-2012-5140", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5140" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the URL loader.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5140", "url": "https://www.suse.com/security/cve/CVE-2012-5140" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5140", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5140" }, { "cve": "CVE-2012-5141", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5141" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.97 does not properly restrict instantiation of the Chromoting client plug-in, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5141", "url": "https://www.suse.com/security/cve/CVE-2012-5141" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5141", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5141" }, { "cve": "CVE-2012-5142", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5142" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.97 does not properly handle history navigation, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5142", "url": "https://www.suse.com/security/cve/CVE-2012-5142" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5142", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5142" }, { "cve": "CVE-2012-5143", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5143" } ], "notes": [ { "category": "general", "text": "Integer overflow in Google Chrome before 23.0.1271.97 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PPAPI image buffers.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5143", "url": "https://www.suse.com/security/cve/CVE-2012-5143" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5143", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5143" }, { "cve": "CVE-2012-5144", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5144" } ], "notes": [ { "category": "general", "text": "Google Chrome before 23.0.1271.97, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, do not properly perform AAC decoding, which allows remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via vectors related to \"an off-by-one overwrite when switching to LTP profile from MAIN.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5144", "url": "https://www.suse.com/security/cve/CVE-2012-5144" }, { "category": "external", "summary": "SUSE Bug 794075 for CVE-2012-5144", "url": "https://bugzilla.suse.com/794075" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2012-5144" }, { "cve": "CVE-2012-5145", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5145" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to SVG layout.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5145", "url": "https://www.suse.com/security/cve/CVE-2012-5145" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5145", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5145" }, { "cve": "CVE-2012-5146", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5146" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 allows remote attackers to bypass the Same Origin Policy via a malformed URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5146", "url": "https://www.suse.com/security/cve/CVE-2012-5146" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5146", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5146" }, { "cve": "CVE-2012-5147", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5147" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOM handling.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5147", "url": "https://www.suse.com/security/cve/CVE-2012-5147" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5147", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5147" }, { "cve": "CVE-2012-5148", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5148" } ], "notes": [ { "category": "general", "text": "The hyphenation functionality in Google Chrome before 24.0.1312.52 does not properly validate file names, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5148", "url": "https://www.suse.com/security/cve/CVE-2012-5148" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5148", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5148" }, { "cve": "CVE-2012-5149", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5149" } ], "notes": [ { "category": "general", "text": "Integer overflow in the audio IPC layer in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5149", "url": "https://www.suse.com/security/cve/CVE-2012-5149" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5149", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5149" }, { "cve": "CVE-2012-5150", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5150" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5150", "url": "https://www.suse.com/security/cve/CVE-2012-5150" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5150", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5150" }, { "cve": "CVE-2012-5152", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5152" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving seek operations on video data.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5152", "url": "https://www.suse.com/security/cve/CVE-2012-5152" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5152", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5152" }, { "cve": "CVE-2012-5153", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5153" } ], "notes": [ { "category": "general", "text": "Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers an out-of-bounds access to stack memory.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5153", "url": "https://www.suse.com/security/cve/CVE-2012-5153" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5153", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2012-5153" }, { "cve": "CVE-2012-5154", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2012-5154" } ], "notes": [ { "category": "general", "text": "Integer overflow in Google Chrome before 24.0.1312.52 on Windows allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to allocation of shared memory.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2012-5154", "url": "https://www.suse.com/security/cve/CVE-2012-5154" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2012-5154", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2012-5154" }, { "cve": "CVE-2013-0830", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0830" } ], "notes": [ { "category": "general", "text": "The IPC layer in Google Chrome before 24.0.1312.52 on Windows omits a NUL character required for termination of an unspecified data structure, which has unknown impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0830", "url": "https://www.suse.com/security/cve/CVE-2013-0830" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0830", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0830" }, { "cve": "CVE-2013-0831", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0831" } ], "notes": [ { "category": "general", "text": "Directory traversal vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to have an unspecified impact by leveraging access to an extension process.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0831", "url": "https://www.suse.com/security/cve/CVE-2013-0831" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0831", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0831" }, { "cve": "CVE-2013-0832", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0832" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0832", "url": "https://www.suse.com/security/cve/CVE-2013-0832" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0832", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0832" }, { "cve": "CVE-2013-0833", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0833" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to printing.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0833", "url": "https://www.suse.com/security/cve/CVE-2013-0833" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0833", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0833" }, { "cve": "CVE-2013-0834", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0834" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving glyphs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0834", "url": "https://www.suse.com/security/cve/CVE-2013-0834" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0834", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0834" }, { "cve": "CVE-2013-0835", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0835" } ], "notes": [ { "category": "general", "text": "Unspecified vulnerability in the Geolocation implementation in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (application crash) via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0835", "url": "https://www.suse.com/security/cve/CVE-2013-0835" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0835", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0835" }, { "cve": "CVE-2013-0836", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0836" } ], "notes": [ { "category": "general", "text": "Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, does not properly implement garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0836", "url": "https://www.suse.com/security/cve/CVE-2013-0836" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0836", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0836" }, { "cve": "CVE-2013-0837", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0837" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of extension tabs.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0837", "url": "https://www.suse.com/security/cve/CVE-2013-0837" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0837", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0837" }, { "cve": "CVE-2013-0838", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0838" } ], "notes": [ { "category": "general", "text": "Google Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0838", "url": "https://www.suse.com/security/cve/CVE-2013-0838" }, { "category": "external", "summary": "SUSE Bug 798326 for CVE-2013-0838", "url": "https://bugzilla.suse.com/798326" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0838" }, { "cve": "CVE-2013-0879", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0879" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0879", "url": "https://www.suse.com/security/cve/CVE-2013-0879" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0879", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0879" }, { "cve": "CVE-2013-0880", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0880" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0880", "url": "https://www.suse.com/security/cve/CVE-2013-0880" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0880", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0880" }, { "cve": "CVE-2013-0881", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0881" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via crafted data in the Matroska container format.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0881", "url": "https://www.suse.com/security/cve/CVE-2013-0881" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0881", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0881" }, { "cve": "CVE-2013-0882", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0882" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0882", "url": "https://www.suse.com/security/cve/CVE-2013-0882" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0882", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0882" }, { "cve": "CVE-2013-0883", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0883" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0883", "url": "https://www.suse.com/security/cve/CVE-2013-0883" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0883", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0883" }, { "cve": "CVE-2013-0884", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0884" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly load Native Client (aka NaCl) code, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0884", "url": "https://www.suse.com/security/cve/CVE-2013-0884" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0884", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0884" }, { "cve": "CVE-2013-0885", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0885" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with the Chrome Web Store, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0885", "url": "https://www.suse.com/security/cve/CVE-2013-0885" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0885", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0885" }, { "cve": "CVE-2013-0886", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0886" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0886", "url": "https://www.suse.com/security/cve/CVE-2013-0886" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0886", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0886" }, { "cve": "CVE-2013-0887", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0887" } ], "notes": [ { "category": "general", "text": "The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0887", "url": "https://www.suse.com/security/cve/CVE-2013-0887" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0887", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0887" }, { "cve": "CVE-2013-0888", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0888" } ], "notes": [ { "category": "general", "text": "Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a \"user gesture check for dangerous file downloads.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0888", "url": "https://www.suse.com/security/cve/CVE-2013-0888" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0888", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0888" }, { "cve": "CVE-2013-0889", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0889" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before proceeding with a file download, which might make it easier for remote attackers to execute arbitrary code via a crafted file.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0889", "url": "https://www.suse.com/security/cve/CVE-2013-0889" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0889", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0889" }, { "cve": "CVE-2013-0890", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0890" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0890", "url": "https://www.suse.com/security/cve/CVE-2013-0890" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0890", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0890" }, { "cve": "CVE-2013-0891", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0891" } ], "notes": [ { "category": "general", "text": "Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0891", "url": "https://www.suse.com/security/cve/CVE-2013-0891" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0891", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0891" }, { "cve": "CVE-2013-0892", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0892" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0892", "url": "https://www.suse.com/security/cve/CVE-2013-0892" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0892", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0892" }, { "cve": "CVE-2013-0893", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0893" } ], "notes": [ { "category": "general", "text": "Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0893", "url": "https://www.suse.com/security/cve/CVE-2013-0893" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0893", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0893" }, { "cve": "CVE-2013-0894", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0894" } ], "notes": [ { "category": "general", "text": "Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0894", "url": "https://www.suse.com/security/cve/CVE-2013-0894" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0894", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0894" }, { "cve": "CVE-2013-0895", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0895" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X, does not properly handle pathnames during copy operations, which might make it easier for remote attackers to execute arbitrary programs via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0895", "url": "https://www.suse.com/security/cve/CVE-2013-0895" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0895", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0895" }, { "cve": "CVE-2013-0896", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0896" } ], "notes": [ { "category": "general", "text": "Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly manage memory during message handling for plug-ins, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0896", "url": "https://www.suse.com/security/cve/CVE-2013-0896" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0896", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0896" }, { "cve": "CVE-2013-0897", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0897" } ], "notes": [ { "category": "general", "text": "Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service via a crafted document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0897", "url": "https://www.suse.com/security/cve/CVE-2013-0897" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0897", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0897" }, { "cve": "CVE-2013-0898", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0898" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0898", "url": "https://www.suse.com/security/cve/CVE-2013-0898" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0898", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-0898" }, { "cve": "CVE-2013-0899", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0899" } ], "notes": [ { "category": "general", "text": "Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0899", "url": "https://www.suse.com/security/cve/CVE-2013-0899" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0899", "url": "https://bugzilla.suse.com/804986" }, { "category": "external", "summary": "SUSE Bug 830356 for CVE-2013-0899", "url": "https://bugzilla.suse.com/830356" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0899" }, { "cve": "CVE-2013-0900", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-0900" } ], "notes": [ { "category": "general", "text": "Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-0900", "url": "https://www.suse.com/security/cve/CVE-2013-0900" }, { "category": "external", "summary": "SUSE Bug 804986 for CVE-2013-0900", "url": "https://bugzilla.suse.com/804986" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-0900" }, { "cve": "CVE-2013-2838", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2838" } ], "notes": [ { "category": "general", "text": "Google V8, as used in Google Chrome before 27.0.1453.93, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2838", "url": "https://www.suse.com/security/cve/CVE-2013-2838" }, { "category": "external", "summary": "SUSE Bug 821601 for CVE-2013-2838", "url": "https://bugzilla.suse.com/821601" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2838" }, { "cve": "CVE-2013-2906", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2906" } ], "notes": [ { "category": "general", "text": "Multiple race conditions in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to threading in core/html/HTMLMediaElement.cpp, core/platform/audio/AudioDSPKernelProcessor.cpp, core/platform/audio/HRTFElevation.cpp, and modules/webaudio/ConvolverNode.cpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2906", "url": "https://www.suse.com/security/cve/CVE-2013-2906" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2906", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2906" }, { "cve": "CVE-2013-2907", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2907" } ], "notes": [ { "category": "general", "text": "The Window.prototype object implementation in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2907", "url": "https://www.suse.com/security/cve/CVE-2013-2907" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2907", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2907" }, { "cve": "CVE-2013-2908", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2908" } ], "notes": [ { "category": "general", "text": "Google Chrome before 30.0.1599.66 uses incorrect function calls to determine the values of NavigationEntry objects, which allows remote attackers to spoof the address bar via vectors involving a response with a 204 (aka No Content) status code.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2908", "url": "https://www.suse.com/security/cve/CVE-2013-2908" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2908", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2908" }, { "cve": "CVE-2013-2909", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2909" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to inline-block rendering for bidirectional Unicode text in an element isolated from its siblings.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2909", "url": "https://www.suse.com/security/cve/CVE-2013-2909" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2909", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2909" }, { "cve": "CVE-2013-2910", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2910" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in modules/webaudio/AudioScheduledSourceNode.cpp in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2910", "url": "https://www.suse.com/security/cve/CVE-2013-2910" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2910", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2910" }, { "cve": "CVE-2013-2911", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2911" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the XSLStyleSheet::compileStyleSheet function in core/xml/XSLStyleSheetLibxslt.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of post-failure recompilation in unspecified libxslt versions.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2911", "url": "https://www.suse.com/security/cve/CVE-2013-2911" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2911", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2911" }, { "cve": "CVE-2013-2912", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2912" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the PepperInProcessRouter::SendToHost function in content/renderer/pepper/pepper_in_process_router.cc in the Pepper Plug-in API (PPAPI) in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a resource-destruction message.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2912", "url": "https://www.suse.com/security/cve/CVE-2013-2912" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2912", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2912" }, { "cve": "CVE-2013-2913", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2913" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the XMLDocumentParser::append function in core/xml/parser/XMLDocumentParser.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an XML document.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2913", "url": "https://www.suse.com/security/cve/CVE-2013-2913" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2913", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2913" }, { "cve": "CVE-2013-2914", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2914" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the color-chooser dialog in Google Chrome before 30.0.1599.66 on Windows allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to color_chooser_dialog.cc and color_chooser_win.cc in browser/ui/views/.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2914", "url": "https://www.suse.com/security/cve/CVE-2013-2914" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2914", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2914" }, { "cve": "CVE-2013-2915", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2915" } ], "notes": [ { "category": "general", "text": "Google Chrome before 30.0.1599.66 preserves pending NavigationEntry objects in certain invalid circumstances, which allows remote attackers to spoof the address bar via a URL with a malformed scheme, as demonstrated by a nonexistent:12121 URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2915", "url": "https://www.suse.com/security/cve/CVE-2013-2915" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2915", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2915" }, { "cve": "CVE-2013-2916", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2916" } ], "notes": [ { "category": "general", "text": "Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to spoof the address bar via vectors involving a response with a 204 (aka No Content) status code, in conjunction with a delay in notifying the user of an attempted spoof.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2916", "url": "https://www.suse.com/security/cve/CVE-2013-2916" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2916", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2916" }, { "cve": "CVE-2013-2917", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2917" } ], "notes": [ { "category": "general", "text": "The ReverbConvolverStage::ReverbConvolverStage function in core/platform/audio/ReverbConvolverStage.cpp in the Web Audio implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to the impulseResponse array.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2917", "url": "https://www.suse.com/security/cve/CVE-2013-2917" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2917", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2917" }, { "cve": "CVE-2013-2918", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2918" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the RenderBlock::collapseAnonymousBlockChild function in core/rendering/RenderBlock.cpp in the DOM implementation in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect handling of parent-child relationships for anonymous blocks.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2918", "url": "https://www.suse.com/security/cve/CVE-2013-2918" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2918", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2918" }, { "cve": "CVE-2013-2919", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2919" } ], "notes": [ { "category": "general", "text": "Google V8, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2919", "url": "https://www.suse.com/security/cve/CVE-2013-2919" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2919", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2919" }, { "cve": "CVE-2013-2920", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2920" } ], "notes": [ { "category": "general", "text": "The DoResolveRelativeHost function in url/url_canon_relative.cc in Google Chrome before 30.0.1599.66 allows remote attackers to cause a denial of service (out-of-bounds read) via a relative URL containing a hostname, as demonstrated by a protocol-relative URL beginning with a //www.google.com/ substring.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2920", "url": "https://www.suse.com/security/cve/CVE-2013-2920" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2920", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2920" }, { "cve": "CVE-2013-2921", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2921" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering certain callback processing during the reporting of a resource entry.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2921", "url": "https://www.suse.com/security/cve/CVE-2013-2921" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2921", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2921" }, { "cve": "CVE-2013-2922", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2922" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in core/html/HTMLTemplateElement.cpp in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that operates on a TEMPLATE element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2922", "url": "https://www.suse.com/security/cve/CVE-2013-2922" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2922", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2922" }, { "cve": "CVE-2013-2923", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2923" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.66 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2923", "url": "https://www.suse.com/security/cve/CVE-2013-2923" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2923", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2923" }, { "cve": "CVE-2013-2924", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2924" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in International Components for Unicode (ICU), as used in Google Chrome before 30.0.1599.66 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2924", "url": "https://www.suse.com/security/cve/CVE-2013-2924" }, { "category": "external", "summary": "SUSE Bug 844084 for CVE-2013-2924", "url": "https://bugzilla.suse.com/844084" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2924" }, { "cve": "CVE-2013-2925", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2925" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in core/xml/XMLHttpRequest.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger multiple conflicting uses of the same XMLHttpRequest object.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2925", "url": "https://www.suse.com/security/cve/CVE-2013-2925" }, { "category": "external", "summary": "SUSE Bug 846444 for CVE-2013-2925", "url": "https://bugzilla.suse.com/846444" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2925" }, { "cve": "CVE-2013-2926", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2926" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the IndentOutdentCommand::tryIndentingAsListItem function in core/editing/IndentOutdentCommand.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to list elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2926", "url": "https://www.suse.com/security/cve/CVE-2013-2926" }, { "category": "external", "summary": "SUSE Bug 846444 for CVE-2013-2926", "url": "https://bugzilla.suse.com/846444" }, { "category": "external", "summary": "SUSE Bug 871792 for CVE-2013-2926", "url": "https://bugzilla.suse.com/871792" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2926" }, { "cve": "CVE-2013-2927", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2927" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the HTMLFormElement::prepareForSubmission function in core/html/HTMLFormElement.cpp in Blink, as used in Google Chrome before 30.0.1599.101, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to submission for FORM elements.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2927", "url": "https://www.suse.com/security/cve/CVE-2013-2927" }, { "category": "external", "summary": "SUSE Bug 846444 for CVE-2013-2927", "url": "https://bugzilla.suse.com/846444" }, { "category": "external", "summary": "SUSE Bug 879607 for CVE-2013-2927", "url": "https://bugzilla.suse.com/879607" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-2927" }, { "cve": "CVE-2013-2928", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2928" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 30.0.1599.101 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2928", "url": "https://www.suse.com/security/cve/CVE-2013-2928" }, { "category": "external", "summary": "SUSE Bug 846444 for CVE-2013-2928", "url": "https://bugzilla.suse.com/846444" }, { "category": "external", "summary": "SUSE Bug 871792 for CVE-2013-2928", "url": "https://bugzilla.suse.com/871792" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2928" }, { "cve": "CVE-2013-2931", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-2931" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.48 allow attackers to execute arbitrary code or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-2931", "url": "https://www.suse.com/security/cve/CVE-2013-2931" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-2931", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-2931" }, { "cve": "CVE-2013-6621", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6621" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the x-webkit-speech attribute in a text INPUT element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6621", "url": "https://www.suse.com/security/cve/CVE-2013-6621" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6621", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6621" }, { "cve": "CVE-2013-6622", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6622" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the HTMLMediaElement::didMoveToNewDocument function in core/html/HTMLMediaElement.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the movement of a media element between documents.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6622", "url": "https://www.suse.com/security/cve/CVE-2013-6622" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6622", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6622" }, { "cve": "CVE-2013-6623", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6623" } ], "notes": [ { "category": "general", "text": "The SVG implementation in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service (out-of-bounds read) by leveraging the use of tree order, rather than transitive dependency order, for layout.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6623", "url": "https://www.suse.com/security/cve/CVE-2013-6623" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6623", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6623" }, { "cve": "CVE-2013-6624", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6624" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6624", "url": "https://www.suse.com/security/cve/CVE-2013-6624" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6624", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6624" }, { "cve": "CVE-2013-6625", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6625" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 31.0.1650.48, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of DOM range objects in circumstances that require child node removal after a (1) mutation or (2) blur event.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6625", "url": "https://www.suse.com/security/cve/CVE-2013-6625" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6625", "url": "https://bugzilla.suse.com/850430" }, { "category": "external", "summary": "SUSE Bug 871792 for CVE-2013-6625", "url": "https://bugzilla.suse.com/871792" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6625" }, { "cve": "CVE-2013-6626", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6626" } ], "notes": [ { "category": "general", "text": "The WebContentsImpl::AttachInterstitialPage function in content/browser/web_contents/web_contents_impl.cc in Google Chrome before 31.0.1650.48 does not cancel JavaScript dialogs upon generating an interstitial warning, which allows remote attackers to spoof the address bar via a crafted web site.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6626", "url": "https://www.suse.com/security/cve/CVE-2013-6626" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6626", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6626" }, { "cve": "CVE-2013-6627", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6627" } ], "notes": [ { "category": "general", "text": "net/http/http_stream_parser.cc in Google Chrome before 31.0.1650.48 does not properly process HTTP Informational (aka 1xx) status codes, which allows remote web servers to cause a denial of service (out-of-bounds read) via a crafted response.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6627", "url": "https://www.suse.com/security/cve/CVE-2013-6627" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6627", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6627" }, { "cve": "CVE-2013-6628", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6628" } ], "notes": [ { "category": "general", "text": "net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server\u0027s X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6628", "url": "https://www.suse.com/security/cve/CVE-2013-6628" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6628", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6628" }, { "cve": "CVE-2013-6629", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6629" } ], "notes": [ { "category": "general", "text": "The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6629", "url": "https://www.suse.com/security/cve/CVE-2013-6629" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6629", "url": "https://bugzilla.suse.com/850430" }, { "category": "external", "summary": "SUSE Bug 873872 for CVE-2013-6629", "url": "https://bugzilla.suse.com/873872" }, { "category": "external", "summary": "SUSE Bug 873873 for CVE-2013-6629", "url": "https://bugzilla.suse.com/873873" }, { "category": "external", "summary": "SUSE Bug 877429 for CVE-2013-6629", "url": "https://bugzilla.suse.com/877429" }, { "category": "external", "summary": "SUSE Bug 877430 for CVE-2013-6629", "url": "https://bugzilla.suse.com/877430" }, { "category": "external", "summary": "SUSE Bug 880246 for CVE-2013-6629", "url": "https://bugzilla.suse.com/880246" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6629" }, { "cve": "CVE-2013-6630", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6630" } ], "notes": [ { "category": "general", "text": "The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6630", "url": "https://www.suse.com/security/cve/CVE-2013-6630" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6630", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6630" }, { "cve": "CVE-2013-6631", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6631" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Channel::SendRTCPPacket function in voice_engine/channel.cc in libjingle in WebRTC, as used in Google Chrome before 31.0.1650.48 and other products, allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via vectors that trigger the absence of certain statistics initialization, leading to the skipping of a required DeRegisterExternalTransport call.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6631", "url": "https://www.suse.com/security/cve/CVE-2013-6631" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6631", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6631" }, { "cve": "CVE-2013-6632", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6632" } ], "notes": [ { "category": "general", "text": "Integer overflow in Google Chrome before 31.0.1650.57 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as demonstrated during a Mobile Pwn2Own competition at PacSec 2013.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6632", "url": "https://www.suse.com/security/cve/CVE-2013-6632" }, { "category": "external", "summary": "SUSE Bug 850430 for CVE-2013-6632", "url": "https://bugzilla.suse.com/850430" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2013-6632" }, { "cve": "CVE-2013-6634", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6634" } ], "notes": [ { "category": "general", "text": "The OneClickSigninHelper::ShowInfoBarIfPossible function in browser/ui/sync/one_click_signin_helper.cc in Google Chrome before 31.0.1650.63 uses an incorrect URL during realm validation, which allows remote attackers to conduct session fixation attacks and hijack web sessions by triggering improper sync after a 302 (aka Found) HTTP status code.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6634", "url": "https://www.suse.com/security/cve/CVE-2013-6634" }, { "category": "external", "summary": "SUSE Bug 854472 for CVE-2013-6634", "url": "https://bugzilla.suse.com/854472" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6634" }, { "cve": "CVE-2013-6635", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6635" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the editing implementation in Blink, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that triggers removal of a node during processing of the DOM tree, related to CompositeEditCommand.cpp and ReplaceSelectionCommand.cpp.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6635", "url": "https://www.suse.com/security/cve/CVE-2013-6635" }, { "category": "external", "summary": "SUSE Bug 854472 for CVE-2013-6635", "url": "https://bugzilla.suse.com/854472" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6635" }, { "cve": "CVE-2013-6636", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6636" } ], "notes": [ { "category": "general", "text": "The FrameLoader::notifyIfInitialDocumentAccessed function in core/loader/FrameLoader.cpp in Blink, as used in Google Chrome before 31.0.1650.63, makes an incorrect check for an empty document during presentation of a modal dialog, which allows remote attackers to spoof the address bar via vectors involving the document.write method.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6636", "url": "https://www.suse.com/security/cve/CVE-2013-6636" }, { "category": "external", "summary": "SUSE Bug 854472 for CVE-2013-6636", "url": "https://bugzilla.suse.com/854472" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6636" }, { "cve": "CVE-2013-6637", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6637" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 31.0.1650.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6637", "url": "https://www.suse.com/security/cve/CVE-2013-6637" }, { "category": "external", "summary": "SUSE Bug 854472 for CVE-2013-6637", "url": "https://bugzilla.suse.com/854472" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6637" }, { "cve": "CVE-2013-6638", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6638" } ], "notes": [ { "category": "general", "text": "Multiple buffer overflows in runtime.cc in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large typed array, related to the (1) Runtime_TypedArrayInitialize and (2) Runtime_TypedArrayInitializeFromArrayLike functions.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6638", "url": "https://www.suse.com/security/cve/CVE-2013-6638" }, { "category": "external", "summary": "SUSE Bug 854473 for CVE-2013-6638", "url": "https://bugzilla.suse.com/854473" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6638" }, { "cve": "CVE-2013-6639", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6639" } ], "notes": [ { "category": "general", "text": "The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via JavaScript code that sets the value of an array element with a crafted index.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6639", "url": "https://www.suse.com/security/cve/CVE-2013-6639" }, { "category": "external", "summary": "SUSE Bug 854473 for CVE-2013-6639", "url": "https://bugzilla.suse.com/854473" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6639" }, { "cve": "CVE-2013-6640", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6640" } ], "notes": [ { "category": "general", "text": "The DehoistArrayIndex function in hydrogen-dehoist.cc (aka hydrogen.cc) in Google V8 before 3.22.24.7, as used in Google Chrome before 31.0.1650.63, allows remote attackers to cause a denial of service (out-of-bounds read) via JavaScript code that sets a variable to the value of an array element with a crafted index.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6640", "url": "https://www.suse.com/security/cve/CVE-2013-6640" }, { "category": "external", "summary": "SUSE Bug 854473 for CVE-2013-6640", "url": "https://bugzilla.suse.com/854473" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6640" }, { "cve": "CVE-2013-6641", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6641" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the FormAssociatedElement::formRemovedFromTree function in core/html/FormAssociatedElement.cpp in Blink, as used in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of the past names map of a FORM element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6641", "url": "https://www.suse.com/security/cve/CVE-2013-6641" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6641", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6641" }, { "cve": "CVE-2013-6643", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6643" } ], "notes": [ { "category": "general", "text": "The OneClickSigninBubbleView::WindowClosing function in browser/ui/views/sync/one_click_signin_bubble_view.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows attackers to trigger a sync with an arbitrary Google account by leveraging improper handling of the closing of an untrusted signin confirm dialog.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6643", "url": "https://www.suse.com/security/cve/CVE-2013-6643" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6643", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6643" }, { "cve": "CVE-2013-6644", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6644" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allow attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6644", "url": "https://www.suse.com/security/cve/CVE-2013-6644" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6644", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6644" }, { "cve": "CVE-2013-6645", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6645" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the OnWindowRemovingFromRootWindow function in content/browser/web_contents/web_contents_view_aura.cc in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving certain print-preview and tab-switch actions that interact with a speech input element.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6645", "url": "https://www.suse.com/security/cve/CVE-2013-6645" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6645", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6645" }, { "cve": "CVE-2013-6646", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6646" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the Web Workers implementation in Google Chrome before 32.0.1700.76 on Windows and before 32.0.1700.77 on Mac OS X and Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the shutting down of a worker process.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6646", "url": "https://www.suse.com/security/cve/CVE-2013-6646" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6646", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6646" }, { "cve": "CVE-2013-6649", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6649" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the RenderSVGImage::paint function in core/rendering/svg/RenderSVGImage.cpp in Blink, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a zero-size SVG image.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6649", "url": "https://www.suse.com/security/cve/CVE-2013-6649" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6649", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6649" }, { "cve": "CVE-2013-6650", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6650" } ], "notes": [ { "category": "general", "text": "The StoreBuffer::ExemptPopularPages function in store-buffer.cc in Google V8 before 3.22.24.16, as used in Google Chrome before 32.0.1700.102, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via vectors that trigger incorrect handling of \"popular pages.\"", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6650", "url": "https://www.suse.com/security/cve/CVE-2013-6650" }, { "category": "external", "summary": "SUSE Bug 861013 for CVE-2013-6650", "url": "https://bugzilla.suse.com/861013" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6650" }, { "cve": "CVE-2013-6653", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6653" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the web contents implementation in Google Chrome before 33.0.1750.117 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving attempted conflicting access to the color chooser.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6653", "url": "https://www.suse.com/security/cve/CVE-2013-6653" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6653", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6653" }, { "cve": "CVE-2013-6654", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6654" } ], "notes": [ { "category": "general", "text": "The SVGAnimateElement::calculateAnimatedValue function in core/svg/SVGAnimateElement.cpp in Blink, as used in Google Chrome before 33.0.1750.117, does not properly handle unexpected data types, which allows remote attackers to cause a denial of service (incorrect cast) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6654", "url": "https://www.suse.com/security/cve/CVE-2013-6654" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6654", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6654" }, { "cve": "CVE-2013-6655", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6655" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in Blink, as used in Google Chrome before 33.0.1750.117, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to improper handling of overflowchanged DOM events during interaction between JavaScript and layout.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6655", "url": "https://www.suse.com/security/cve/CVE-2013-6655" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6655", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6655" }, { "cve": "CVE-2013-6656", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6656" } ], "notes": [ { "category": "general", "text": "The XSSAuditor::init function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, processes POST requests by using the body of a redirecting page instead of the body of a redirect target, which allows remote attackers to obtain sensitive information via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6656", "url": "https://www.suse.com/security/cve/CVE-2013-6656" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6656", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6656" }, { "cve": "CVE-2013-6657", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6657" } ], "notes": [ { "category": "general", "text": "core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 33.0.1750.117, inserts the about:blank URL during certain blocking of FORM elements within HTTP requests, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6657", "url": "https://www.suse.com/security/cve/CVE-2013-6657" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6657", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6657" }, { "cve": "CVE-2013-6658", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6658" } ], "notes": [ { "category": "general", "text": "Multiple use-after-free vulnerabilities in the layout implementation in Blink, as used in Google Chrome before 33.0.1750.117, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving (1) running JavaScript code during execution of the updateWidgetPositions function or (2) making a call into a plugin during execution of the updateWidgetPositions function.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6658", "url": "https://www.suse.com/security/cve/CVE-2013-6658" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6658", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2013-6658" }, { "cve": "CVE-2013-6659", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6659" } ], "notes": [ { "category": "general", "text": "The SSLClientSocketNSS::Core::OwnAuthCertHandler function in net/socket/ssl_client_socket_nss.cc in Google Chrome before 33.0.1750.117 does not prevent changes to server X.509 certificates during renegotiations, which allows remote SSL servers to trigger use of a new certificate chain, inconsistent with the user\u0027s expectations, by initiating a TLS renegotiation.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6659", "url": "https://www.suse.com/security/cve/CVE-2013-6659" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6659", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6659" }, { "cve": "CVE-2013-6660", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6660" } ], "notes": [ { "category": "general", "text": "The drag-and-drop implementation in Google Chrome before 33.0.1750.117 does not properly restrict the information in WebDropData data structures, which allows remote attackers to discover full pathnames via a crafted web site.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6660", "url": "https://www.suse.com/security/cve/CVE-2013-6660" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6660", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6660" }, { "cve": "CVE-2013-6661", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2013-6661" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google Chrome before 33.0.1750.117 allow attackers to bypass the sandbox protection mechanism after obtaining renderer access, or have other impact, via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2013-6661", "url": "https://www.suse.com/security/cve/CVE-2013-6661" }, { "category": "external", "summary": "SUSE Bug 865500 for CVE-2013-6661", "url": "https://bugzilla.suse.com/865500" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2013-6661" }, { "cve": "CVE-2014-0574", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-0574" } ], "notes": [ { "category": "general", "text": "Double free vulnerability in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and OS X and before 11.2.202.418 on Linux, Adobe AIR before 15.0.0.356, Adobe AIR SDK before 15.0.0.356, and Adobe AIR SDK \u0026 Compiler before 15.0.0.356 allows attackers to execute arbitrary code via unspecified vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-0574", "url": "https://www.suse.com/security/cve/CVE-2014-0574" }, { "category": "external", "summary": "SUSE Bug 905032 for CVE-2014-0574", "url": "https://bugzilla.suse.com/905032" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2014-0574" }, { "cve": "CVE-2014-1700", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1700" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in modules/speech/SpeechSynthesis.cpp in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of a certain utterance data structure.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-1700", "url": "https://www.suse.com/security/cve/CVE-2014-1700" }, { "category": "external", "summary": "SUSE Bug 866959 for CVE-2014-1700", "url": "https://bugzilla.suse.com/866959" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2014-1700" }, { "cve": "CVE-2014-1701", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1701" } ], "notes": [ { "category": "general", "text": "The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink, as used in Google Chrome before 33.0.1750.149, does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function, which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-1701", "url": "https://www.suse.com/security/cve/CVE-2014-1701" }, { "category": "external", "summary": "SUSE Bug 866959 for CVE-2014-1701", "url": "https://bugzilla.suse.com/866959" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "moderate" } ], "title": "CVE-2014-1701" }, { "cve": "CVE-2014-1702", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1702" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the DatabaseThread::cleanupDatabaseThread function in modules/webdatabase/DatabaseThread.cpp in the web database implementation in Blink, as used in Google Chrome before 33.0.1750.149, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of scheduled tasks during shutdown of a thread.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-1702", "url": "https://www.suse.com/security/cve/CVE-2014-1702" }, { "category": "external", "summary": "SUSE Bug 866959 for CVE-2014-1702", "url": "https://bugzilla.suse.com/866959" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2014-1702" }, { "cve": "CVE-2014-1703", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1703" } ], "notes": [ { "category": "general", "text": "Use-after-free vulnerability in the WebSocketDispatcherHost::SendOrDrop function in content/browser/renderer_host/websocket_dispatcher_host.cc in the Web Sockets implementation in Google Chrome before 33.0.1750.149 might allow remote attackers to bypass the sandbox protection mechanism by leveraging an incorrect deletion in a certain failure case.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-1703", "url": "https://www.suse.com/security/cve/CVE-2014-1703" }, { "category": "external", "summary": "SUSE Bug 866959 for CVE-2014-1703", "url": "https://bugzilla.suse.com/866959" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "important" } ], "title": "CVE-2014-1703" }, { "cve": "CVE-2014-1704", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1704" } ], "notes": [ { "category": "general", "text": "Multiple unspecified vulnerabilities in Google V8 before 3.23.17.18, as used in Google Chrome before 33.0.1750.149, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.", "title": "CVE description" } ], "product_status": { "recommended": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] }, "references": [ { "category": "external", "summary": "CVE-2014-1704", "url": "https://www.suse.com/security/cve/CVE-2014-1704" }, { "category": "external", "summary": "SUSE Bug 866959 for CVE-2014-1704", "url": "https://bugzilla.suse.com/866959" }, { "category": "external", "summary": "SUSE Bug 868707 for CVE-2014-1704", "url": "https://bugzilla.suse.com/868707" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-113.0.5672.92-1.1.x86_64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.aarch64", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.ppc64le", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.s390x", "openSUSE Tumbleweed:ungoogled-chromium-chromedriver-113.0.5672.92-1.1.x86_64" ] } ], "threats": [ { "category": "impact", "date": "2024-06-15T00:00:00Z", "details": "critical" } ], "title": "CVE-2014-1704" }, { "cve": "CVE-2014-1705", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2014-1705" } ], "notes": [ { "category": "general", "text": "Google V8, as used in Google Chrome before 33.0.1750.152 on OS X and Linux and before 33.0.1750.154 on Windows, allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.", "title": "CVE description" } ], "product_status": {