| Summary: | Firefox 102.4 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | davidwhodgins, fri, joselp, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | nss, firefox | CVE: | |
| Status comment: | |||
|
Description
David Walser
2022-10-17 18:11:55 CEST
Updates have been submitted to the build system and should be available by the end of the day. Release notes should be available tomorrow. Assignee:
luigiwalser =>
qa-bugs Installed in MGA8-64 Plasma, all works fine for the moment. - Audio and video ok. - Addons ok. - Settings and spanish translation ok. Updated from 102.3 version without issues in firefox profile. CC:
(none) =>
joselp mga8-64 Plasma nvidia-current i7 OK, been using it today: clean update Settings and open tabs kept Swedish localisation Some video sites Some banking and shops Old minor problem: The about box say "mageia 1.0" https://bugs.mageia.org/show_bug.cgi?id=30867#c4 CC:
(none) =>
fri Security issues fixed: https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/ Advisory: ======================== Updated firefox packages fix security vulnerabilities: A same-origin policy violation could have allowed the theft of cross-origin URL entries, leaking the result of a redirect, via performance.getEntries() (CVE-2022-42927). Certain types of allocations were missing annotations that, if the Garbage Collector was in a specific state, could have lead to memory corruption in the JS engine and a potentially exploitable crash (CVE-2022-42928). If a website called window.print() in a particular way, it could cause a denial of service of the browser, which may persist beyond browser restart depending on the user's session restore settings (CVE-2022-42929). Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 102.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2022-42932). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42927 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42928 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42929 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42932 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/uV-FYp6SUr8 https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_84.html https://www.mozilla.org/en-US/security/advisories/mfsa2022-45/ Advisory committed to svn. Validating the update. Whiteboard:
(none) =>
MGA8-64-OK An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2022-0378.html Status:
NEW =>
RESOLVED RedHat has issued an advisory for this on October 20: https://access.redhat.com/errata/RHSA-2022:7071 |