Linux · 
Red Hat · Security advisory · August 26, 2020
Red Hat · Security advisory · August 26, 2020RHSA-2020:3557: firefox security update
RHSA-2020:3557, released August 26, 2020, fixes 11 CVEs in firefox (version 0:78.2.0-2.el8_2). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
11
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0194
80th percentile
Priority of the 11 CVEs
Patch now 0
Urgent 0
High 4
Routine 7
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| firefox | RHEL 8 | 0:78.2.0-2.el8_2 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2020-12422 | Firefox ESR: In non-standard configurations, a JPEG image created by JavaScript could have caused an internal variable… | 8.8 | 0.0194 | None reported |
| High | CVE-2020-12390 | Firefox ESR: Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. | 9.8 | 0.0162 | None reported |
| High | CVE-2020-15656 | Firefox ESR and 2 others: JIT optimizations involving the Javascript arguments object could confuse later optimizations. | 8.8 | 0.0152 | None reported |
| High | CVE-2020-15669 | firefox: ELSA-2020-3557: firefox security update (IMPORTANT) | 8.8 | 0.0112 | None reported |
| Routine | CVE-2020-12424 | Firefox ESR: When constructing a permission prompt for WebRTC, a URI was supplied from the content process. | 6.5 | 0.0161 | None reported |
| Routine | CVE-2020-12425 | Firefox ESR: Due to confusion processing a hyphen character in Date.parse(), a one-byte out of bounds read could have… | 6.5 | 0.0157 | None reported |
| Routine | CVE-2020-15654 | Firefox ESR and 2 others: When in an endless loop, a website specifying a custom cursor using CSS could make it look like the user… | 6.5 | 0.0142 | None reported |
| Routine | CVE-2020-15653 | Firefox ESR and 2 others: An iframe sandbox element with the allow-popups flag could be bypassed when using noopener links. | 6.5 | 0.0140 | None reported |
| Routine | CVE-2020-15664 | Firefox ESR and 2 others: By holding a reference to the eval() function from an about:blank window, a malicious webpage could have… | 6.5 | 0.0139 | None reported |
| Routine | CVE-2020-15658 | Firefox ESR and 2 others: The code for downloading files did not properly take care of special characters, which led to an attacker… | 6.5 | 0.0139 | None reported |
| Routine | CVE-2020-15648 | Firefox ESR: Using object or embed tags, it was possible to frame other websites, even if they disallowed framing… | 6.5 | 0.0114 | None reported |
Showing 1 to 11 of 11
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.