Scientific Linux alert SLSA-2020:0085-1 (firefox)

From:
             
 
Pat Riehecky <riehecky@fnal.gov> 
To:
             
 
scientific-linux-errata@listserv.fnal.gov 
Subject:
             
 
Security ERRATA Critical: firefox on SL7.x x86_64 
Date:
             
 
Mon, 13 Jan 2020 21:16:21 -0000
Message-ID:
             
 
<20200113211621.25699.62504@slpackages.fnal.gov>
Synopsis: Critical: firefox security update
Advisory ID:       SLSA-2020:0085-1
Issue Date:        2020-01-13
CVE Numbers:       CVE-2019-17016
                   CVE-2019-17017
                   CVE-2019-17022
                   CVE-2019-17024
                   CVE-2019-17026
--

This update upgrades Firefox to version 68.4.1 ESR.

Security Fix(es):

* Mozilla: IonMonkey type confusion with StoreElementHole and
FallibleStoreElement (CVE-2019-17026)

* Mozilla: Bypass of @namespace CSS sanitization during pasting
(CVE-2019-17016)

* Mozilla: Type Confusion in XPCVariant.cpp (CVE-2019-17017)

* Mozilla: Memory safety bugs fixed in Firefox 72 and Firefox ESR 68.4
(CVE-2019-17024)

* Mozilla: CSS sanitization does not escape HTML tags (CVE-2019-17022)
--

SL7
  x86_64
    firefox-68.4.1-1.el7_7.x86_64.rpm
    firefox-debuginfo-68.4.1-1.el7_7.x86_64.rpm
    firefox-68.4.1-1.el7_7.i686.rpm
    firefox-debuginfo-68.4.1-1.el7_7.i686.rpm

- Scientific Linux Development Team