Bug 29734 - Firefox 91.4
Summary: Firefox 91.4
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal critical
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-12-06 18:45 CET by David Walser
Modified: 2022-10-26 18:39 CEST (History)
9 users (show)

See Also:
Source RPM: firefox
CVE:
Status comment:


Attachments

Description David Walser 2021-12-06 18:45:38 CET
Mozilla has released Firefox 91.4.0 today (December 6):
https://www.mozilla.org/en-US/firefox/91.4.0/releasenotes/

The release notes for 91.4.0 are not available yet as of this posting.

No rootcerts, nspr, or nss updates this time.

Package list should be as follows.

Updated packages in core/updates_testing:
========================================
firefox-91.4.0-1.mga8
firefox-ru-91.4.0-1.mga8
firefox-uk-91.4.0-1.mga8
firefox-be-91.4.0-1.mga8
firefox-el-91.4.0-1.mga8
firefox-kk-91.4.0-1.mga8
firefox-th-91.4.0-1.mga8
firefox-pa_IN-91.4.0-1.mga8
firefox-ka-91.4.0-1.mga8
firefox-ja-91.4.0-1.mga8
firefox-bg-91.4.0-1.mga8
firefox-sr-91.4.0-1.mga8
firefox-hy_AM-91.4.0-1.mga8
firefox-ko-91.4.0-1.mga8
firefox-zh_TW-91.4.0-1.mga8
firefox-vi-91.4.0-1.mga8
firefox-zh_CN-91.4.0-1.mga8
firefox-hu-91.4.0-1.mga8
firefox-bn-91.4.0-1.mga8
firefox-hi_IN-91.4.0-1.mga8
firefox-ar-91.4.0-1.mga8
firefox-sk-91.4.0-1.mga8
firefox-cs-91.4.0-1.mga8
firefox-ur-91.4.0-1.mga8
firefox-hsb-91.4.0-1.mga8
firefox-lt-91.4.0-1.mga8
firefox-te-91.4.0-1.mga8
firefox-fr-91.4.0-1.mga8
firefox-he-91.4.0-1.mga8
firefox-pl-91.4.0-1.mga8
firefox-sq-91.4.0-1.mga8
firefox-fa-91.4.0-1.mga8
firefox-de-91.4.0-1.mga8
firefox-oc-91.4.0-1.mga8
firefox-tr-91.4.0-1.mga8
firefox-kab-91.4.0-1.mga8
firefox-es_MX-91.4.0-1.mga8
firefox-es_AR-91.4.0-1.mga8
firefox-es_CL-91.4.0-1.mga8
firefox-pt_PT-91.4.0-1.mga8
firefox-fy_NL-91.4.0-1.mga8
firefox-pt_BR-91.4.0-1.mga8
firefox-gl-91.4.0-1.mga8
firefox-cy-91.4.0-1.mga8
firefox-sv_SE-91.4.0-1.mga8
firefox-gd-91.4.0-1.mga8
firefox-km-91.4.0-1.mga8
firefox-ro-91.4.0-1.mga8
firefox-mr-91.4.0-1.mga8
firefox-gu_IN-91.4.0-1.mga8
firefox-hr-91.4.0-1.mga8
firefox-sl-91.4.0-1.mga8
firefox-nl-91.4.0-1.mga8
firefox-es_ES-91.4.0-1.mga8
firefox-eo-91.4.0-1.mga8
firefox-ca-91.4.0-1.mga8
firefox-da-91.4.0-1.mga8
firefox-fi-91.4.0-1.mga8
firefox-eu-91.4.0-1.mga8
firefox-ia-91.4.0-1.mga8
firefox-nn_NO-91.4.0-1.mga8
firefox-nb_NO-91.4.0-1.mga8
firefox-br-91.4.0-1.mga8
firefox-id-91.4.0-1.mga8
firefox-tl-91.4.0-1.mga8
firefox-my-91.4.0-1.mga8
firefox-ta-91.4.0-1.mga8
firefox-en_GB-91.4.0-1.mga8
firefox-szl-91.4.0-1.mga8
firefox-en_CA-91.4.0-1.mga8
firefox-an-91.4.0-1.mga8
firefox-ast-91.4.0-1.mga8
firefox-kn-91.4.0-1.mga8
firefox-az-91.4.0-1.mga8
firefox-si-91.4.0-1.mga8
firefox-en_US-91.4.0-1.mga8
firefox-et-91.4.0-1.mga8
firefox-ff-91.4.0-1.mga8
firefox-lij-91.4.0-1.mga8
firefox-uz-91.4.0-1.mga8
firefox-is-91.4.0-1.mga8
firefox-mk-91.4.0-1.mga8
firefox-lv-91.4.0-1.mga8
firefox-bs-91.4.0-1.mga8
firefox-ga_IE-91.4.0-1.mga8
firefox-it-91.4.0-1.mga8
firefox-ms-91.4.0-1.mga8
firefox-xh-91.4.0-1.mga8
firefox-af-91.4.0-1.mga8

from SRPMS:
firefox-91.4.0-1.mga8.src.rpm
firefox-l10n-91.4.0-1.mga8.src.rpm
Comment 1 David Walser 2021-12-06 20:28:49 CET
Updates pushed to the build system and should be available on mirrors in a few hours.

Assignee: luigiwalser => qa-bugs

Comment 2 Hugues Detavernier 2021-12-07 09:43:59 CET
Hi,

Installed and tested on Mageia Virtualbox X64 XFCE

works fine with streaming and audio, bank ... sites.
Extensions (adblock, Bitwarden) work too.

CC: (none) => hdetavernier

Comment 3 Jose Manuel López 2021-12-07 10:25:38 CET
Hi, 

Installed in Mageia Vbox X64 Plasma Kde, works fine for the moment, banks, youtube, and other webs, ok, addons ok, right now I am writing from this version without issues.

CC: (none) => joselpddj

Comment 4 Herman Viaene 2021-12-07 15:53:19 CET
MGA8-64 Plasma on Lenovo B50
No istallation issues.
Running it now, youtube mahna-mahnam, newspapersite OK, extension for Belgian eid works OK.

CC: (none) => herman.viaene

Comment 5 Guillaume Royer 2021-12-07 21:18:44 CET
MGA8 XFCE 64 Core I3 4Go RAM
No installation issues
Running with Netflix and MLO Forum :)
Bank site OK

All is ok

CC: (none) => guillaume.royer

Comment 6 Morgan Leijström 2021-12-07 21:44:23 CET
OK here 64 bit Plasma, Nvidia-current, Swedish localisation;
Various sites including bank, video, shopping... keep using it.

CC: (none) => fri

Comment 7 David Walser 2021-12-07 23:10:14 CET
Security issues fixed:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/

Advisory:
========================

Updated firefox packages fix security vulnerabilities:

Under certain circumstances, asynchronous functions could have caused a
navigation to fail but expose the target URL (CVE-2021-43536).

An incorrect type conversion of sizes from 64bit to 32bit integers allowed an
attacker to corrupt memory leading to a potentially exploitable crash due to a
heap buffer overflow when using structured clone (CVE-2021-43537).

By misusing a race in our notification code, an attacker could have forcefully
hidden the notification for pages that had received both full screen and
pointer lock access, which could have been used for spoofing attacks
(CVE-2021-43538).

Failure to correctly record the location of live pointers across wasm instance
calls resulted in a GC occurring within the call not tracing those live
pointers. This could have led to a use-after-free causing a potentially
exploitable crash (CVE-2021-43539).

When invoking protocol handlers for external protocols, a supplied parameter
URL containing spaces was not properly escaped (CVE-2021-43541).

Using XMLHttpRequest, an attacker could have identified installed applications
by probing error messages for loading external protocols (CVE-2021-43542).

Documents loaded with the CSP sandbox directive could have escaped the
sandbox's script restriction by embedding additional content (CVE-2021-43543).

Using the Location API in a loop could have caused severe application hangs
and crashes (CVE-2021-43545).

It was possible to recreate previous cursor spoofing attacks against users
with a zoomed native cursor (CVE-2021-43546).

Mozilla developers and community members Julian Hector, Randell Jesup,
Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano reported
memory safety bugs present in Firefox ESR 91.3. Some of these bugs showed
evidence of memory corruption and we presume that with enough effort some of
these could have been exploited to run arbitrary code (MOZ-2021-0009).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43536
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43537
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43538
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43539
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43541
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43542
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43543
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43545
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43546
https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/
Comment 8 David Walser 2021-12-08 17:15:21 CET
RedHat has issued an advisory for this today (December 8):
https://access.redhat.com/errata/RHSA-2021:5013
Comment 9 Brian Rockwell 2021-12-09 03:55:33 CET
MGA8-64, GNOME, Laptop

English installation.

No issues so far using youtube, email, typical high advertisement website.

---------------

MGA8-64, Xfce, old laptop

English installation

Same - no issues

CC: (none) => brtians1

Comment 10 Thomas Andrews 2021-12-10 15:36:04 CET
Installed US English versions of this and Thunderbird at the same time, on two separate machines. No installation issues, and no regressions noted as I used it for a few hours.

Lots of tests, no problems, calling this one OK, and validating. Advisory in Comment 7.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK

Dave Hodgins 2021-12-10 21:02:32 CET

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 11 Mageia Robot 2021-12-10 23:20:25 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0551.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

Comment 12 David Walser 2022-10-26 18:39:19 CEST
I was notified by Christian Fischer that the MOZ vulnerabilities have CVEs.  SVN advisory updated.

Mageia Advisory: https://advisories.mageia.org/MGASA-2021-0551.html
Mozilla Advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-53/
Suggested changes:
MOZ-2021-0009 -> CVE-2021-4129

Note You need to log in before you can comment on or make changes to this bug.