| Summary: | Firefox 91.11 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, fri, herman.viaene, joselp, nicolas.salguero, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | rootcerts, nss, firefox | CVE: | |
| Status comment: | |||
| Bug Depends on: | |||
| Bug Blocks: | 30587 | ||
|
Description
David Walser
2022-06-27 23:05:17 CEST
Security issues fixed: https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/ Advisory: ======================== Updated firefox packages fix security vulnerabilities: If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution (CVE-2022-2200). An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy (CVE-2022-31744). Content Security Policy sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI. An iframe that was not permitted to run scripts could do so if the user clicked on a javascript: link (CVE-2022-34468). Navigations between XML documents may have led to a use-after-free in nsSHistory and potentially exploitable crash (CVE-2022-34470). If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, resulting in incorrect error pages being shown (CVE-2022-34472). A malicious website that could create a popup could have resized the popup to overlay the address bar with its own content, resulting in potential user confusion or spoofing attacks (CVE-2022-34479). In the nsTArray_Impl::ReplaceElementsAt() function, an integer overflow could have occurred when the number of elements to replace was too large for the container (CVE-2022-34481). The Mozilla Fuzzing Team reported potential vulnerabilities present in Firefox ESR 91.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2022-34484). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-2200 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-31744 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34468 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34470 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34472 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34479 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34481 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34484 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/EvvZnF-wh14 https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_80.html https://www.mozilla.org/en-US/security/advisories/mfsa2022-25/ Assignee:
luigiwalser =>
qa-bugs MGA8-64 Plasma on Acer Aspire 5253 No installation issues. Surfing and searching, I cann't find anything wrong. CC:
(none) =>
herman.viaene Mga8-x64 on Vbox Asus Laptop No installation issues. Web ok, banks ok, video and audio ok. All ok for the moment. CC:
(none) =>
joselp mga8-64, Plasma, nvidia-current, intel i7 Swedish localisation Settings and tabs kept Used a few banks and shops, played some video sites CC:
(none) =>
fri
Nicolas Salguero
2022-06-29 14:18:30 CEST
Blocks:
(none) =>
30587 Looks good here, too. OKing, and validating. Advisory in Comment 1. Keywords:
(none) =>
validated_update RedHat has issued an advisory for this on June 30: https://access.redhat.com/errata/RHSA-2022:5469
Dave Hodgins
2022-07-04 23:27:54 CEST
Keywords:
(none) =>
advisory An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0251.html Status:
NEW =>
RESOLVED |