Linux · Security advisory · December 16, 2020
RHSA-2020:5562: firefox security update
RHSA-2020:5562, released December 16, 2020, fixes 7 CVEs in firefox (version 0:78.6.0-1.el8_3). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
7
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0190
79th percentile
Priority of the 7 CVEs
Patch now 0
Urgent 0
High 4
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | RHEL 8 | 0:78.6.0-1.el8_3 |
CVEs this fix closes
| Priority | CVE | Title | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| High | CVE-2020-26971 | Firefox ESR and 2 others: Certain blit values provided by the user were not properly constrained leading to a heap buffer overflow… | 8.8 | 0.0190 | None reported | |
| High | CVE-2020-26973 | Firefox ESR and 2 others: Certain input to the CSS Sanitizer confused it, resulting in incorrect components being removed. | 8.8 | 0.0162 | None reported | |
| High | CVE-2020-35113 | Firefox ESR and 2 others: Mozilla developers reported memory safety bugs present in Firefox 83 and Firefox ESR 78.5. | 8.8 | 0.0157 | None reported | |
| High | CVE-2020-26974 | Firefox ESR and 2 others: When flex-basis was used on a table wrapper, a StyleGenericFlexBasis object could have been incorrectly… | 8.8 | 0.0153 | None reported | |
| Routine | CVE-2020-35111 | Firefox ESR and 2 others: When an extension with the proxy permission registered to receive <all_urls>, the proxy.onRequest callback… | 4.3 | 0.0143 | None reported | |
| Routine | CVE-2020-26978 | Firefox ESR and 2 others: Using techniques that built on the slipstream research, a malicious webpage could have exposed both an… | 6.1 | 0.0133 | None reported | |
| Routine | CVE-2020-16042 | firefox: Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. This... | 6.5 | 0.0111 | None reported |
Showing 1 to 7 of 7
1