Linux · Security advisory · April 14, 2023

RHSA-2023:1786: Security update for 2 packages

RHSA-2023:1786, released April 14, 2023, fixes 9 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0095
61st percentile

Priority of the 9 CVEs

Patch now 0 Urgent 0 High 7 Routine 2

Fixed package versions

ProductReleaseFixed in
firefoxRHEL 90:102.10.0-1.el9_1
firefox-x11RHEL 90:102.10.0-1.el9_1

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-1999 Chromium: CVE-2023-1999 Use after free in libwebp 7.5 0.0095 None reported
High CVE-2023-29535 Mozilla Firefox and 4 others: Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly… 7.5 0.0075 None reported
High CVE-2023-29541 Mozilla Firefox and 4 others: Improper Encoding or Escaping of Output 8.8 0.0074 None reported
High CVE-2023-29539 Mozilla Firefox and 4 others: When handling the filename directive in the Content-Disposition header, the filename would be truncated… 8.8 0.0074 None reported
High CVE-2023-29550 Mozilla Firefox and 4 others: Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. 8.8 0.0071 None reported
High CVE-2023-29536 Mozilla Firefox and 4 others: An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled… 8.8 0.0070 None reported
High CVE-2023-29533 Mozilla Firefox and 4 others: A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>,… 7.5 0.0057 None reported
Routine CVE-2023-29548 Mozilla Firefox and 4 others: A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. 6.5 0.0070 None reported
Routine CVE-2023-1945 Mozilla Thunderbird and 1 other: Out-of-bounds Write 6.5 0.0064 None reported
Showing 1 to 9 of 9 1