| Summary: | Firefox 91.6 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, fri, hdetavernier, herman.viaene, joselp, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | nss, firefox | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 30012 | ||
|
Description
David Walser
2022-02-07 19:03:26 CET
Packages submitted to the build system and should be available in a few hours. Assignee:
luigiwalser =>
qa-bugs OK mga8-64 Plasma nvidia-current Swedish Used a couple hours including shops, banking, video. Viewing and printing pdf. CC:
(none) =>
fri MGA8-64 Plasma, Intel video, wired Internet, US English. No installation issues. Tried several sites, DuckDuckGo, Youtube, my local newspaper's site, downloaded a pdf to Okular, a few Mageia pages, Facebook, this website. No issues noted. CC:
(none) =>
andrewsfarm
David Walser
2022-02-08 21:57:23 CET
Blocks:
(none) =>
30012 Advisory: ======================== Updated firefox packages fix security vulnerabilities: If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so, bypass the prompt which grants the new version the new requested permissions (CVE-2022-22754). If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have been changed into an executable script which would have run arbitrary code after the user clicked on it (CVE-2022-22756). If a document created a sandboxed iframe without allow-scripts, and subsequently appended an element to the iframe's document that e.g. had a JavaScript event handler - the event handler would have run despite the iframe's sandbox (CVE-2022-22759). When importing resources using Web Workers, error messages would distinguish the difference between application/javascript responses and non-script responses. This could have been abused to learn information cross-origin (CVE-2022-22760). Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors directive when it was used in the Web Extension's Content Security Policy (CVE-2022-22761). When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible (CVE-2022-22763). Mozilla developers and community members Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 91.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2022-22764). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22754 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22756 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22759 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22760 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22761 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22763 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22764 https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_75.html https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/ Updated from Firefox 91.5, works fine for the moment in Mga Vbox x86_64, language spanish, addons ok, video and audio ok. Greetings!! CC:
(none) =>
joselpddj package firefox-0:91.6.0-1.mga8.x86_64 does not verify: Payload SHA256 ALT digest: BAD (Expected b1552d2fb4104675cc1318a989375b6ad35e4dde69938e54c952f0425d6a4c8a != 65b7ba6b0f9cc1197664be1952a5a9fc62360ea3ac28ac59e028e92bcc0152d6) CC:
(none) =>
herman.viaene Clear your urpmi cache and try again. @David urpmi -clean didn't help and /var/cache/urpmi was empty. I'm using tuxinator for QARepo, so I disabled the local repo, enabled the standard mirror-list-core-updates-testing and all went well. Usual testing in Dutch gave no issues. Mageia 8 x64 XFCE on virtualbox. Updated from a previous version. No installation issues. Bookmarks, language parameters, video and audio ok CC:
(none) =>
hdetavernier I'm going to send this on, and let it wait for Thunderbird. Validating. Advisory in Comment 4. CC:
(none) =>
sysadmin-bugs
Dave Hodgins
2022-02-12 17:19:02 CET
Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0057.html Resolution:
(none) =>
FIXED RedHat has issued an advisory for this today (February 14): https://access.redhat.com/errata/RHSA-2022:0510 |