Advisories » MGASA-2018-0202

Updated firefox packages fix security vulnerability

Publication date: 15 Apr 2018
Modification date: 15 Apr 2018
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-5125 , CVE-2018-5127 , CVE-2018-5129 , CVE-2018-5130 , CVE-2018-5131 , CVE-2018-5144 , CVE-2018-5145 , CVE-2018-5148

Description

Memory safety bugs fixed in Firefox ESR 52.7 (CVE-2018-5125).

Buffer overflow manipulating SVG animatedPathSegList (CVE-2018-5127).

Out-of-bounds write with malformed IPC messages (CVE-2018-5129).

Mismatched RTP payload type can trigger memory corruption (CVE-2018-5130).

Fetch API improperly returns cached copies of no-store/no-cache resources
(CVE-2018-5131).

Integer overflow during Unicode conversion (CVE-2018-5144).

Memory safety bugs fixed in Firefox ESR 52.7 (CVE-2018-5145).

A use-after-free vulnerability can occur in the compositor during certain
graphics operations when a raw pointer is used instead of a reference counted
one. This results in a potentially exploitable crash (CVE-2018-5148).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=22776
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-07/
• https://www.mozilla.org/en-US/security/advisories/mfsa2018-10/
• https://www.mozilla.org/security/known-vulnerabilities/firefox-esr/
• https://access.redhat.com/errata/RHSA-2018:0527
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5125
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5127
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5129
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5130
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5131
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5144
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5145
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5148

SRPMS

6/core

• firefox-52.7.3-2.mga6
• firefox-l10n-52.7.3-1.mga6
• nspr-4.19-1.mga6