Linux · Security advisory · November 30, 2020
RHSA-2020:5237: firefox security update
RHSA-2020:5237, released November 30, 2020, fixes 10 CVEs in firefox (version 0:78.5.0-1.el8_3). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
10
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0257
85th percentile
Priority of the 10 CVEs
Patch now 0
Urgent 0
High 3
Routine 7
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | RHEL 8 | 0:78.5.0-1.el8_3 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2020-26960 | Firefox ESR and 2 others: If the Compact() method was called on an nsTArray, the array could have been reallocated without updating… | 8.8 | 0.0156 | None reported | |
| High | CVE-2020-26968 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 82 and Firefox ESR 78.4. | 8.8 | 0.0151 | None reported | |
| High | CVE-2020-26959 | Firefox ESR and 2 others: During browser shutdown, reference decrementing could have occured on a previously freed object, resulting… | 8.8 | 0.0130 | None reported | |
| Routine | CVE-2020-16012 | Firefox ESR and 1 other: Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote… | 4.3 | 0.0257 | None reported | |
| Routine | CVE-2020-26958 | Firefox ESR and 2 others: Firefox did not block execution of scripts with incorrect MIME types when the response was intercepted… | 6.1 | 0.0136 | None reported | |
| Routine | CVE-2020-26953 | Firefox ESR and 2 others: It was possible to cause the browser to enter fullscreen mode without displaying the security UI; thus… | 4.3 | 0.0129 | None reported | |
| Routine | CVE-2020-26965 | Firefox ESR and 2 others: Some websites have a feature "Show Password" where clicking a button will change a password field into… | 6.5 | 0.0126 | None reported | |
| Routine | CVE-2020-26956 | Firefox ESR and 2 others: In some cases, removing HTML elements during sanitization would keep existing SVG event handlers and… | 6.1 | 0.0123 | None reported | |
| Routine | CVE-2020-26961 | Firefox ESR and 2 others: When DNS over HTTPS is in use, it intentionally filters RFC1918 and related IP ranges from the responses… | 6.5 | 0.0117 | None reported | |
| Routine | CVE-2020-26951 | Firefox ESR and 2 others: A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire, even… | 6.1 | 0.0105 | None reported |
Showing 1 to 10 of 10
1