Bug 1728430 (CVE-2019-11709)

Summary: CVE-2019-11709 Mozilla: Memory safety bugs fixed in Firefox 68 and Firefox ESR 60.8
Product: [Other] Security Response Reporter: Doran Moppert <dmoppert>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: cschalle, gecko-bugs-nobody, jhorak, stransky
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-07-12 13:08:32 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1726061, 1726062, 1726063, 1726064, 1726065, 1726882, 1726883, 1726884, 1726885, 1726886    
Bug Blocks: 1726057    

Description Doran Moppert 2019-07-10 00:26:29 UTC
Mozilla developers and community members reported memory safety bugs present in Firefox 67 and Firefox ESR 60.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.


External Reference:

https://www.mozilla.org/en-US/security/advisories/mfsa2019-22/#CVE-2019-11709

Comment 1 Doran Moppert 2019-07-10 00:26:32 UTC
Acknowledgments:

Name: the Mozilla project
Upstream: Andreea Pavel, Christian Holler, Honza Bambas, Jason Kratzer, Jeff Gilbert

Comment 2 errata-xmlrpc 2019-07-11 17:19:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1764 https://access.redhat.com/errata/RHSA-2019:1764

Comment 3 errata-xmlrpc 2019-07-11 17:51:50 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1765 https://access.redhat.com/errata/RHSA-2019:1765

Comment 4 errata-xmlrpc 2019-07-11 17:55:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1763 https://access.redhat.com/errata/RHSA-2019:1763

Comment 5 Product Security DevOps Team 2019-07-12 13:08:32 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11709

Comment 6 errata-xmlrpc 2019-07-15 12:40:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1775 https://access.redhat.com/errata/RHSA-2019:1775

Comment 7 errata-xmlrpc 2019-07-15 13:35:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2019:1777 https://access.redhat.com/errata/RHSA-2019:1777

Comment 8 errata-xmlrpc 2019-07-16 20:27:06 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1799 https://access.redhat.com/errata/RHSA-2019:1799