Issued:
  2021-07-15
Updated:
  2021-07-15

# RHSA-2021:2743 - Security Advisory

## Synopsis

Important: firefox security update

## Type/Severity

Security Advisory: Important

## Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

## Topic

An update for firefox is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

## Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 78.12.0 ESR.

Security Fix(es):

- Mozilla: Use-after-free in accessibility features of a document (CVE-2021-29970)
- Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12 (CVE-2021-29976)
- chromium-browser: Out of bounds write in ANGLE (CVE-2021-30547)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the update, Firefox must be restarted for the changes to take effect.

## Affected Products

- Red Hat Enterprise Linux for x86_64 8 x86_64
- Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
- Red Hat Enterprise Linux Server - AUS 8.4 x86_64
- Red Hat Enterprise Linux for IBM z Systems 8 s390x
- Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
- Red Hat Enterprise Linux for Power, little endian 8 ppc64le
- Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
- Red Hat Enterprise Linux Server - TUS 8.4 x86_64
- Red Hat Enterprise Linux for ARM 64 8 aarch64
- Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
- Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4 ppc64le
- Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4 x86_64

## Fixes

- BZ - 1970109 - CVE-2021-30547 chromium-browser: Out of bounds write in ANGLE
- BZ - 1982013 - CVE-2021-29970 Mozilla: Use-after-free in accessibility features of a document
- BZ - 1982014 - CVE-2021-29976 Mozilla: Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12

## CVEs

- CVE-2021-29970
- CVE-2021-29976
- CVE-2021-30547

## References

- https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package name for more details.

## Red Hat Enterprise Linux for x86_64 8

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
x86_64
firefox-78.12.0-1.el8_4.x86_64.rpm | SHA-256: b695560e4d71e756e4f23300b3799dbf9a0501d438a1cfa6cc60e17204ef4b9f
firefox-debuginfo-78.12.0-1.el8_4.x86_64.rpm | SHA-256: cd469dda0b92c02ce97ab7189588e609e366bc27814af793c719324b2ca7de90
firefox-debugsource-78.12.0-1.el8_4.x86_64.rpm | SHA-256: 98cb2bf96336d22a822f0efb612c9ef8bf8e7c39c6b6e90e15f86dfdb8730d68

## Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
x86_64
firefox-78.12.0-1.el8_4.x86_64.rpm | SHA-256: b695560e4d71e756e4f23300b3799dbf9a0501d438a1cfa6cc60e17204ef4b9f
firefox-debuginfo-78.12.0-1.el8_4.x86_64.rpm | SHA-256: cd469dda0b92c02ce97ab7189588e609e366bc27814af793c719324b2ca7de90
firefox-debugsource-78.12.0-1.el8_4.x86_64.rpm | SHA-256: 98cb2bf96336d22a822f0efb612c9ef8bf8e7c39c6b6e90e15f86dfdb8730d68

## Red Hat Enterprise Linux Server - AUS 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
x86_64
firefox-78.12.0-1.el8_4.x86_64.rpm | SHA-256: b695560e4d71e756e4f23300b3799dbf9a0501d438a1cfa6cc60e17204ef4b9f
firefox-debuginfo-78.12.0-1.el8_4.x86_64.rpm | SHA-256: cd469dda0b92c02ce97ab7189588e609e366bc27814af793c719324b2ca7de90
firefox-debugsource-78.12.0-1.el8_4.x86_64.rpm | SHA-256: 98cb2bf96336d22a822f0efb612c9ef8bf8e7c39c6b6e90e15f86dfdb8730d68

## Red Hat Enterprise Linux for IBM z Systems 8

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
s390x
firefox-78.12.0-1.el8_4.s390x.rpm | SHA-256: c4d8fd21d5b6fb375a31a5008dee39125468db10fc2578f9184ca709b0649124
firefox-debuginfo-78.12.0-1.el8_4.s390x.rpm | SHA-256: 3e14dbd2ea086ca9bf8999b66e108e15897b7b9fa37b2958098e2f9999c69b5c
firefox-debugsource-78.12.0-1.el8_4.s390x.rpm | SHA-256: 4d9a3b46a1b4932bb9ad618c6b16389c6ed22a7a50d544c354389521e5cac5ca

## Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
s390x
firefox-78.12.0-1.el8_4.s390x.rpm | SHA-256: c4d8fd21d5b6fb375a31a5008dee39125468db10fc2578f9184ca709b0649124
firefox-debuginfo-78.12.0-1.el8_4.s390x.rpm | SHA-256: 3e14dbd2ea086ca9bf8999b66e108e15897b7b9fa37b2958098e2f9999c69b5c
firefox-debugsource-78.12.0-1.el8_4.s390x.rpm | SHA-256: 4d9a3b46a1b4932bb9ad618c6b16389c6ed22a7a50d544c354389521e5cac5ca

## Red Hat Enterprise Linux for Power, little endian 8

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
ppc64le
firefox-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 53be1f8f91b3e0ff3110f78c3eddabbbc2da618a0a03898dba8a4ed2e1e79c64
firefox-debuginfo-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 2bd8c3c8cad9e90485a44fcc6c2aae2d504a30ee8611c45e699cf3b6efcbfe9a
firefox-debugsource-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: bf8399647be6b276ec3db408f11c89ed2e067b78fb7be019a5df85fad68e7efc

## Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
ppc64le
firefox-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 53be1f8f91b3e0ff3110f78c3eddabbbc2da618a0a03898dba8a4ed2e1e79c64
firefox-debuginfo-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 2bd8c3c8cad9e90485a44fcc6c2aae2d504a30ee8611c45e699cf3b6efcbfe9a
firefox-debugsource-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: bf8399647be6b276ec3db408f11c89ed2e067b78fb7be019a5df85fad68e7efc

## Red Hat Enterprise Linux Server - TUS 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
x86_64
firefox-78.12.0-1.el8_4.x86_64.rpm | SHA-256: b695560e4d71e756e4f23300b3799dbf9a0501d438a1cfa6cc60e17204ef4b9f
firefox-debuginfo-78.12.0-1.el8_4.x86_64.rpm | SHA-256: cd469dda0b92c02ce97ab7189588e609e366bc27814af793c719324b2ca7de90
firefox-debugsource-78.12.0-1.el8_4.x86_64.rpm | SHA-256: 98cb2bf96336d22a822f0efb612c9ef8bf8e7c39c6b6e90e15f86dfdb8730d68

## Red Hat Enterprise Linux for ARM 64 8

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
aarch64
firefox-78.12.0-1.el8_4.aarch64.rpm | SHA-256: 9c2212b6759ffc7e929608b93dbea308f805fc41e3a6ef86e18225fe64fad1a2
firefox-debuginfo-78.12.0-1.el8_4.aarch64.rpm | SHA-256: f540717a77978630bbc2e87f6b19b2187455cfcccdcb5e95906cc601e36aceef
firefox-debugsource-78.12.0-1.el8_4.aarch64.rpm | SHA-256: dffacf744c6ebc840fc71a3876eb09acdafdf94c4b574e3cfc9fa858fe9163d7

## Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
aarch64
firefox-78.12.0-1.el8_4.aarch64.rpm | SHA-256: 9c2212b6759ffc7e929608b93dbea308f805fc41e3a6ef86e18225fe64fad1a2
firefox-debuginfo-78.12.0-1.el8_4.aarch64.rpm | SHA-256: f540717a77978630bbc2e87f6b19b2187455cfcccdcb5e95906cc601e36aceef
firefox-debugsource-78.12.0-1.el8_4.aarch64.rpm | SHA-256: dffacf744c6ebc840fc71a3876eb09acdafdf94c4b574e3cfc9fa858fe9163d7

## Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
ppc64le
firefox-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 53be1f8f91b3e0ff3110f78c3eddabbbc2da618a0a03898dba8a4ed2e1e79c64
firefox-debuginfo-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: 2bd8c3c8cad9e90485a44fcc6c2aae2d504a30ee8611c45e699cf3b6efcbfe9a
firefox-debugsource-78.12.0-1.el8_4.ppc64le.rpm | SHA-256: bf8399647be6b276ec3db408f11c89ed2e067b78fb7be019a5df85fad68e7efc

## Red Hat Enterprise Linux Server - Update Services for SAP Solutions 8.4

SRPM
firefox-78.12.0-1.el8_4.src.rpm | SHA-256: 2fdab145c121ce9d3775caa1acb3d8e8aefc147e97125a317b5f570855bc7db4
x86_64
firefox-78.12.0-1.el8_4.x86_64.rpm | SHA-256: b695560e4d71e756e4f23300b3799dbf9a0501d438a1cfa6cc60e17204ef4b9f
firefox-debuginfo-78.12.0-1.el8_4.x86_64.rpm | SHA-256: cd469dda0b92c02ce97ab7189588e609e366bc27814af793c719324b2ca7de90
firefox-debugsource-78.12.0-1.el8_4.x86_64.rpm | SHA-256: 98cb2bf96336d22a822f0efb612c9ef8bf8e7c39c6b6e90e15f86dfdb8730d68

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.