Packages submitted to the build system and should be available in a few hours.

Assignee: luigiwalser => qa-bugs

OK mga8-64 Plasma nvidia-current Swedish
Used a couple hours including shops, banking, video.
Viewing and printing pdf.

CC: (none) => fri

MGA8-64 Plasma, Intel video, wired Internet, US English.

No installation issues. Tried several sites, DuckDuckGo, Youtube, my local newspaper's site, downloaded a pdf to Okular, a few Mageia pages, Facebook, this website. No issues noted.

CC: (none) => andrewsfarm

Advisory:
========================

Updated firefox packages fix security vulnerabilities:

If a user installed an extension of a particular type, the extension could
have auto-updated itself and while doing so, bypass the prompt which grants
the new version the new requested permissions (CVE-2022-22754).

If a user was convinced to drag and drop an image to their desktop or other
folder, the resulting object could have been changed into an executable script
which would have run arbitrary code after the user clicked on it
(CVE-2022-22756).

If a document created a sandboxed iframe without allow-scripts, and
subsequently appended an element to the iframe's document that e.g. had a
JavaScript event handler - the event handler would have run despite the
iframe's sandbox (CVE-2022-22759).

When importing resources using Web Workers, error messages would distinguish
the difference between application/javascript responses and non-script
responses. This could have been abused to learn information cross-origin
(CVE-2022-22760).

Web-accessible extension pages (pages with a moz-extension:// scheme) were not
correctly enforcing the frame-ancestors directive when it was used in the Web
Extension's Content Security Policy (CVE-2022-22761).

When a worker is shutdown, it was possible to cause script to run late in the
lifecycle, at a point after where it should not be possible (CVE-2022-22763).

Mozilla developers and community members Paul Adenot and the Mozilla Fuzzing
Team reported memory safety bugs present in Firefox ESR 91.5. Some of these
bugs showed evidence of memory corruption and we presume that with enough
effort some of these could have been exploited to run arbitrary code
(CVE-2022-22764).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22754
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22756
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22759
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22760
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22761
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22763
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22764
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_75.html
https://www.mozilla.org/en-US/security/advisories/mfsa2022-05/

Updated from Firefox 91.5, works fine for the moment in Mga Vbox x86_64, language spanish, addons ok, video and audio ok.

Greetings!!

CC: (none) => joselpddj

package firefox-0:91.6.0-1.mga8.x86_64 does not verify: Payload SHA256 ALT digest: BAD (Expected b1552d2fb4104675cc1318a989375b6ad35e4dde69938e54c952f0425d6a4c8a != 65b7ba6b0f9cc1197664be1952a5a9fc62360ea3ac28ac59e028e92bcc0152d6)

CC: (none) => herman.viaene

Clear your urpmi cache and try again.

@David
urpmi -clean didn't help and /var/cache/urpmi was empty.
I'm using tuxinator for QARepo, so I disabled the local repo, enabled the standard mirror-list-core-updates-testing and all went well.
Usual testing in Dutch gave no issues.

Mageia 8 x64 XFCE on virtualbox.

Updated from a previous version.
No installation issues.

Bookmarks, language parameters, video and audio ok

CC: (none) => hdetavernier

I'm going to send this on, and let it wait for Thunderbird.

Validating. Advisory in Comment 4.

CC: (none) => sysadmin-bugs
Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0057.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

RedHat has issued an advisory for this today (February 14):
https://access.redhat.com/errata/RHSA-2022:0510