firefox-52.7.3-1.0.1.el7.AXS7

エラータID: AXSA:2018-2939:04

Release date: 
Wednesday, April 18, 2018 - 18:05
Subject: 
firefox-52.7.3-1.0.1.el7.AXS7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
High
Description: 

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 52.7.3 ESR.

Security Fix(es):

* firefox: Use-after-free in compositor potentially allows code execution (CVE-2018-5148)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2018-5148
** RESERVED **
This candidate has been reserved by an organization or individual that
will use it when announcing a new security problem. When the
candidate has been publicized, the details for this candidate will be provided.

Solution: 

Update packages.

CVEs: 
CVE-2018-5148
A use-after-free vulnerability can occur in the compositor during certain graphics operations when a raw pointer is used instead of a reference counted one. This results in a potentially exploitable crash. This vulnerability affects Firefox ESR < 52.7.3 and Firefox < 59.0.2.
Additional Info: 

N/A

Download: 

SRPMS
  1. firefox-52.7.3-1.0.1.el7.AXS7.src.rpm
    MD5: 3529d43ee759a3dca5bf5f1a9d3f137e
    SHA-256: 86d8bf6d2ae05418e3cd8fdb7b13923b706716cc1bfafbfedff359db27843c47
    Size: 368.88 MB

Asianux Server 7 for x86_64
  1. firefox-52.7.3-1.0.1.el7.AXS7.x86_64.rpm
    MD5: fbe1786a8ebd780fb7e4ad849e0f195f
    SHA-256: 1030c00e6354b602f54e8b776a056887d63a7255eb1bb598d1a84b48e108edaa
    Size: 83.04 MB
  2. firefox-52.7.3-1.0.1.el7.AXS7.i686.rpm
    MD5: 8001013e0f3eb1a749c6051dcc82f1ee
    SHA-256: 5f84b74b22d8d9978467713781d44bf24aa9547374643fa8ebdfe89e588c0a88
    Size: 83.28 MB