Packages are in the process of being submitted to the build system and should be available later today.

Advisory:
========================

Updated firefox packages fix security vulnerabilities:

Documents in deeply-nested cross-origin browsing contexts could have obtained
permissions granted to the top-level origin, bypassing the existing prompt and
wrongfully inheriting the top-level permissions (CVE-2022-29909).

Firefox did not properly protect against top-level navigations for an iframe
sandbox with a policy relaxed through a keyword like
allow-top-navigation-by-user-activation (CVE-2022-29911).

Requests initiated through reader mode did not properly omit cookies with a
SameSite attribute (CVE-2022-29912).

When reusing existing popups Firefox would have allowed them to cover the
fullscreen notification UI, which could have enabled browser spoofing attacks
(CVE-2022-29914).

Firefox behaved slightly differently for already known resources when loading
CSS resources involving CSS variables. This could have been used to probe the
browser history (CVE-2022-29916).

Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the
Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 91.8.
Some of these bugs showed evidence of memory corruption and we presume that
with enough effort some of these could have been exploited to run arbitrary
code (CVE-2022-29917).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29909
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29911
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29912
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29914
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29916
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29917
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_78.html
https://www.mozilla.org/en-US/security/advisories/mfsa2022-17/

Packages have been submitted to the build system and will be available eventually.

Assignee: luigiwalser => qa-bugs

OK mga8-64, Plasma, nvidia-current, Swedish locale
Some banking sites, webshops, video sites, printing.

CC: (none) => fri

mga8, x64
Updated and restarted firefox.  Restored previous session.
Working fine - local file browser, command-line invocation of Youtube video, interactive word puzzle, Google Maps....

CC: (none) => tarazed25

MGA8-64, Gnome, Asus Laptop

AMD A6-9225 RADEON R4
RTL8723BE 
Bluetooth

The following 5 packages are going to be installed:

- firefox-91.9.0-1.mga8.x86_64
- firefox-en_CA-91.9.0-1.mga8.noarch
- firefox-en_GB-91.9.0-1.mga8.noarch
- firefox-en_US-91.9.0-1.mga8.noarch
- lib64nss3-3.78.0-1.mga8.x86_64

945B of disk space will be freed.

---- restarted system

I've used it on my favorite websites (video/audio/text) - no issues

CC: (none) => brtians1

RedHat has issued an advisory for this today (May 4):
https://access.redhat.com/errata/RHSA-2022:1705

Hi,

Updated from 91.8 in Mageia 8 Plasma x86_64. Writing from new version now. No issues for the moment.

Banks, sync, addons, spanish locale, youtube ok.

Greetings!

CC: (none) => joselp

Updated the mga8-64 US English Firefox and Thunderbird in one operation. No issues to report with either.

CC: (none) => andrewsfarm

Validating the update. Advisory committed to svn.

Keywords: (none) => advisory, validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => davidwhodgins, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0162.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED