An earlier fix for an Inter-process Communication (IPC) vulnerability, CVE-2011-3079, added authentication to communication between IPC endpoints and server parents during IPC process creation. This authentication is insufficient for channels created after the IPC process is started, leading to the authentication not being correctly applied to later channels. This could allow for a sandbox escape through IPC channels due to lack of message validation in the listener process. External Reference: https://www.mozilla.org/en-US/security/advisories/mfsa2019-02/#CVE-2018-18505
Acknowledgments: Name: the Mozilla project Upstream: Jed Davis
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:0218 https://access.redhat.com/errata/RHSA-2019:0218
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:0219 https://access.redhat.com/errata/RHSA-2019:0219
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2019:0269 https://access.redhat.com/errata/RHSA-2019:0269
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2019:0270 https://access.redhat.com/errata/RHSA-2019:0270