| Summary: | Firefox 102.13 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, davidwhodgins, fri, herman.viaene, mageia, sysadmin-bugs, tarazed25 |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA8-64-OK | ||
| Source RPM: | nss, firefox | CVE: | |
| Status comment: | |||
|
Description
David Walser
2023-07-05 23:31:38 CEST
David Walser
2023-07-05 23:31:53 CEST
Whiteboard:
(none) =>
MGA8TOO Advisory: ======================== Updated firefox packages fix security vulnerabilities: An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS (CVE-2023-37201). Cross-compartment wrappers wrapping a scripted proxy could have caused objects from other compartments to be stored in the main compartment resulting in a use-after-free in SpiderMonkey (CVE-2023-37202). A website could have obscured the fullscreen notification by using a URL with a scheme handled by an external program, such as a mailto URL. This could have led to user confusion and possible spoofing attacks (CVE-2023-37207). When opening Diagcab files, Firefox did not warn the user that these files may contain malicious code (CVE-2023-37208). Memory safety bugs present in Firefox ESR 102.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2023-37211). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37201 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37202 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37207 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37208 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37211 https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/i-wiqdBIjMI https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_91.html https://www.mozilla.org/en-US/security/advisories/mfsa2023-23/ Updates submitted to the build system, freeze move request posted for Cauldron, updated packages should be available on mirrors by the end of the day. Assignee:
luigiwalser =>
qa-bugs I thought we do a regular testing here (qa) and move it afterwards, the regular way (maybe move to core and not to updates) CC:
(none) =>
mageia MGA9-64 Plasma on an HP Pavilion 15. This install is an upgrade from a MGA8 install, I believe from the beta1 iso but I'm not sure now. After editing the list in comment 0 to change all "mga8" to "mga9" and "lib" to "lib64" I used it in qarepo to download the packages. I believe this is my first use of qarepo in Cauldron, definitely the first on this install, so it made for a good test of that, too. There were no installation issues for the US English version. Checked this out with my normal morning use of a laptop, read my newspaper, checked in on Facebook, looked at a couple of other sites, then threw in watching a brief video on Youtube. No issues to report. CC:
(none) =>
andrewsfarm MGA8-64 MATE on Acer Aspire. No installation issues. Newspaper site all OK CC:
(none) =>
herman.viaene
Nicolas Salguero
2023-07-10 09:30:10 CEST
Blocks:
(none) =>
32090 OK-64 on Cauldron, been using it some hours with various sites incl shops, banking and video Whiteboard:
MGA8TOO =>
(none) Mageia8, x86_64 : Mate Running here all afternoon for various sites and links from emails. CC:
(none) =>
tarazed25 Cauldron packages moved to release and are on second rc build Giving this an MGA8 OK. Waiting on validation for Bug 32090 (Thunderbird), which has not been assigned to QA yet. Whiteboard:
(none) =>
MGA8-64-OK While thunderbird depends on the firefox update, firefox does not depend on thunderbird. Quick testing shows that thunderbird-102.12.0-1.mga8 still works ok with this firefox update installed. Validating the update. Advisory committed to svn. Keywords:
(none) =>
advisory, validated_update RedHat has issued an advisory for this on July 13: https://access.redhat.com/errata/RHSA-2023:4071 An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2023-0235.html Resolution:
(none) =>
FIXED
Nicolas Salguero
2023-08-30 10:47:59 CEST
Blocks:
32090 =>
(none) |