RHEL 7 : firefox (RHSA-2017:1106)

critical Nessus Plugin ID 99572

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

An update for firefox is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mozilla Firefox is an open source web browser.

This update upgrades Firefox to version 52.1.0 ESR.

Security Fix(es) :

* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5437, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469)

Red Hat would like to thank the Mozilla project for reporting these issues. Upstream acknowledges Mozilla developers and community, Nils, Holger Fuhrmannek, Atte Kettunen, Takeshi Terada, Huzaifa Sidhpurwala, Nicolas Gregoire, Chamal De Silva, Chun Han Hsiao, Ivan Fratric of Google Project Zero, Anonymous working with Trend Micro's Zero Day Initiative, Haik Aftandilian, Paul Theriault, Julian Hector, Petr Cerny, Jordi Chancel, and Heather Miller of Google Skia team as the original reporters.

Solution

Update the affected firefox and / or firefox-debuginfo packages.

See Also

https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/

https://access.redhat.com/errata/RHSA-2017:1106

https://access.redhat.com/security/cve/cve-2016-10195

https://access.redhat.com/security/cve/cve-2016-10196

https://access.redhat.com/security/cve/cve-2016-10197

https://access.redhat.com/security/cve/cve-2017-5429

https://access.redhat.com/security/cve/cve-2017-5430

https://access.redhat.com/security/cve/cve-2017-5432

https://access.redhat.com/security/cve/cve-2017-5433

https://access.redhat.com/security/cve/cve-2017-5434

https://access.redhat.com/security/cve/cve-2017-5435

https://access.redhat.com/security/cve/cve-2017-5436

https://access.redhat.com/security/cve/cve-2017-5438

https://access.redhat.com/security/cve/cve-2017-5439

https://access.redhat.com/security/cve/cve-2017-5440

https://access.redhat.com/security/cve/cve-2017-5441

https://access.redhat.com/security/cve/cve-2017-5442

https://access.redhat.com/security/cve/cve-2017-5443

https://access.redhat.com/security/cve/cve-2017-5444

https://access.redhat.com/security/cve/cve-2017-5445

https://access.redhat.com/security/cve/cve-2017-5446

https://access.redhat.com/security/cve/cve-2017-5447

https://access.redhat.com/security/cve/cve-2017-5448

https://access.redhat.com/security/cve/cve-2017-5449

https://access.redhat.com/security/cve/cve-2017-5451

https://access.redhat.com/security/cve/cve-2017-5454

https://access.redhat.com/security/cve/cve-2017-5455

https://access.redhat.com/security/cve/cve-2017-5456

https://access.redhat.com/security/cve/cve-2017-5459

https://access.redhat.com/security/cve/cve-2017-5460

https://access.redhat.com/security/cve/cve-2017-5464

https://access.redhat.com/security/cve/cve-2017-5465

https://access.redhat.com/security/cve/cve-2017-5466

https://access.redhat.com/security/cve/cve-2017-5467

https://access.redhat.com/security/cve/cve-2017-5469

Plugin Details

Severity: Critical

ID: 99572

File Name: redhat-RHSA-2017-1106.nasl

Version: 3.17

Type: local

Agent: unix

Published: 4/21/2017

Updated: 5/29/2020

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:firefox, p-cpe:/a:redhat:enterprise_linux:firefox-debuginfo, cpe:/o:redhat:enterprise_linux:7, cpe:/o:redhat:enterprise_linux:7.3, cpe:/o:redhat:enterprise_linux:7.4, cpe:/o:redhat:enterprise_linux:7.5, cpe:/o:redhat:enterprise_linux:7.6, cpe:/o:redhat:enterprise_linux:7.7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/20/2017

Vulnerability Publication Date: 3/15/2017

Reference Information

CVE: CVE-2016-10195, CVE-2016-10196, CVE-2016-10197, CVE-2017-5429, CVE-2017-5430, CVE-2017-5432, CVE-2017-5433, CVE-2017-5434, CVE-2017-5435, CVE-2017-5436, CVE-2017-5438, CVE-2017-5439, CVE-2017-5440, CVE-2017-5441, CVE-2017-5442, CVE-2017-5443, CVE-2017-5444, CVE-2017-5445, CVE-2017-5446, CVE-2017-5447, CVE-2017-5448, CVE-2017-5449, CVE-2017-5451, CVE-2017-5454, CVE-2017-5455, CVE-2017-5456, CVE-2017-5459, CVE-2017-5460, CVE-2017-5464, CVE-2017-5465, CVE-2017-5466, CVE-2017-5467, CVE-2017-5469

RHSA: 2017:1106