RHSA-2024:0025HighCVSS 8.8

Red Hat Security Advisory: firefox security update

Published
January 2, 2024
Last Modified
November 5, 2026

🔗 CVE IDs covered (11)

CVE-2023-6867 →CVE-2023-6856 →CVE-2023-6857 →CVE-2023-6858 →CVE-2023-6859 →CVE-2023-6861 →CVE-2023-6864 →CVE-2023-6865 →CVE-2023-6860 →CVE-2023-6862 →CVE-2023-6863 →

📋 Description

CVE-2023-6856 — Mozilla: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver CVE-2023-6857 — Mozilla: Symlinks may resolve to smaller than expected buffers CVE-2023-6858 — Mozilla: Heap buffer overflow in nsTextFragment CVE-2023-6859 — Mozilla: Use-after-free in PR_GetIdentitiesLayer CVE-2023-6860 — Mozilla: Potential sandbox escape due to VideoBridge lack of texture validation CVE-2023-6861 — Mozilla: Heap buffer overflow affected nsWindow::PickerOpen(void) in headless mode CVE-2023-6862 — Mozilla: Use-after-free in nsDNSService CVE-2023-6863 — Mozilla: Undefined behavior in ShutdownObserver() CVE-2023-6864 — Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 CVE-2023-6865 — Mozilla: Potential exposure of uninitialized data in EncryptingOutputStream CVE-2023-6867 — Mozilla: Clickjacking permission prompts using the popup transition

🎯 Affected products18

  • Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:115.6.0-1.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:115.6.0-1.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:115.6.0-1.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:115.6.0-1.el9_3.src as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-0:115.6.0-1.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:115.6.0-1.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:115.6.0-1.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:115.6.0-1.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debuginfo-0:115.6.0-1.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:115.6.0-1.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:115.6.0-1.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:115.6.0-1.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-debugsource-0:115.6.0-1.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:115.6.0-1.el9_3.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:115.6.0-1.el9_3.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:115.6.0-1.el9_3.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)
  • firefox-x11-0:115.6.0-1.el9_3.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the update, Firefox must be restarted for the changes to take effect.

🔗 References (14)