Bug 30669 - Firefox 91.12
Summary: Firefox 91.12
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks: 30681
  Show dependency treegraph
 
Reported: 2022-07-25 17:22 CEST by David Walser
Modified: 2022-08-01 17:07 CEST (History)
6 users (show)

See Also:
Source RPM: nss, firefox
CVE:
Status comment:


Attachments

Description David Walser 2022-07-25 17:22:45 CEST
Mozilla has released Firefox 91.12.0 today (July 25):
https://www.mozilla.org/en-US/firefox/91.12.0/releasenotes/

The release notes have not been posted yet.

There are also rootcerts and nss updates:
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/jYrL4b47r3A
https://firefox-source-docs.mozilla.org/security/nss/releases/index.html
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_81.html

Package list should be as follows.

Updated packages in core/updates_testing:
========================================
nss-3.81.0-1.mga8
nss-doc-3.81.0-1.mga8
libnss3-3.81.0-1.mga8
libnss-devel-3.81.0-1.mga8
libnss-static-devel-3.81.0-1.mga8
firefox-91.12.0-1.mga8
firefox-ru-91.12.0-1.mga8
firefox-uk-91.12.0-1.mga8
firefox-be-91.12.0-1.mga8
firefox-el-91.12.0-1.mga8
firefox-kk-91.12.0-1.mga8
firefox-th-91.12.0-1.mga8
firefox-pa_IN-91.12.0-1.mga8
firefox-ka-91.12.0-1.mga8
firefox-ja-91.12.0-1.mga8
firefox-bg-91.12.0-1.mga8
firefox-sr-91.12.0-1.mga8
firefox-hy_AM-91.12.0-1.mga8
firefox-ko-91.12.0-1.mga8
firefox-zh_TW-91.12.0-1.mga8
firefox-vi-91.12.0-1.mga8
firefox-zh_CN-91.12.0-1.mga8
firefox-hu-91.12.0-1.mga8
firefox-bn-91.12.0-1.mga8
firefox-hi_IN-91.12.0-1.mga8
firefox-ar-91.12.0-1.mga8
firefox-sk-91.12.0-1.mga8
firefox-cs-91.12.0-1.mga8
firefox-ur-91.12.0-1.mga8
firefox-hsb-91.12.0-1.mga8
firefox-lt-91.12.0-1.mga8
firefox-te-91.12.0-1.mga8
firefox-fr-91.12.0-1.mga8
firefox-he-91.12.0-1.mga8
firefox-pl-91.12.0-1.mga8
firefox-sq-91.12.0-1.mga8
firefox-fa-91.12.0-1.mga8
firefox-de-91.12.0-1.mga8
firefox-oc-91.12.0-1.mga8
firefox-tr-91.12.0-1.mga8
firefox-kab-91.12.0-1.mga8
firefox-es_MX-91.12.0-1.mga8
firefox-es_AR-91.12.0-1.mga8
firefox-es_CL-91.12.0-1.mga8
firefox-pt_PT-91.12.0-1.mga8
firefox-fy_NL-91.12.0-1.mga8
firefox-pt_BR-91.12.0-1.mga8
firefox-gl-91.12.0-1.mga8
firefox-cy-91.12.0-1.mga8
firefox-sv_SE-91.12.0-1.mga8
firefox-gd-91.12.0-1.mga8
firefox-km-91.12.0-1.mga8
firefox-ro-91.12.0-1.mga8
firefox-mr-91.12.0-1.mga8
firefox-gu_IN-91.12.0-1.mga8
firefox-hr-91.12.0-1.mga8
firefox-sl-91.12.0-1.mga8
firefox-nl-91.12.0-1.mga8
firefox-es_ES-91.12.0-1.mga8
firefox-eo-91.12.0-1.mga8
firefox-ca-91.12.0-1.mga8
firefox-da-91.12.0-1.mga8
firefox-fi-91.12.0-1.mga8
firefox-eu-91.12.0-1.mga8
firefox-ia-91.12.0-1.mga8
firefox-nn_NO-91.12.0-1.mga8
firefox-nb_NO-91.12.0-1.mga8
firefox-br-91.12.0-1.mga8
firefox-id-91.12.0-1.mga8
firefox-tl-91.12.0-1.mga8
firefox-my-91.12.0-1.mga8
firefox-ta-91.12.0-1.mga8
firefox-en_GB-91.12.0-1.mga8
firefox-szl-91.12.0-1.mga8
firefox-en_CA-91.12.0-1.mga8
firefox-an-91.12.0-1.mga8
firefox-ast-91.12.0-1.mga8
firefox-kn-91.12.0-1.mga8
firefox-az-91.12.0-1.mga8
firefox-si-91.12.0-1.mga8
firefox-en_US-91.12.0-1.mga8
firefox-et-91.12.0-1.mga8
firefox-ff-91.12.0-1.mga8
firefox-lij-91.12.0-1.mga8
firefox-uz-91.12.0-1.mga8
firefox-is-91.12.0-1.mga8nss-3.81.0-1.mga8
nss-doc-3.81.0-1.mga8
libnss3-3.81.0-1.mga8
libnss-devel-3.81.0-1.mga8
libnss-static-devel-3.81.0-1.mga8
firefox-91.12.0-1.mga8
firefox-ru-91.12.0-1.mga8
firefox-uk-91.12.0-1.mga8
firefox-be-91.12.0-1.mga8
firefox-el-91.12.0-1.mga8
firefox-kk-91.12.0-1.mga8
firefox-th-91.12.0-1.mga8
firefox-pa_IN-91.12.0-1.mga8
firefox-ka-91.12.0-1.mga8
firefox-ja-91.12.0-1.mga8
firefox-bg-91.12.0-1.mga8
firefox-sr-91.12.0-1.mga8
firefox-hy_AM-91.12.0-1.mga8
firefox-ko-91.12.0-1.mga8
firefox-zh_TW-91.12.0-1.mga8
firefox-vi-91.12.0-1.mga8
firefox-zh_CN-91.12.0-1.mga8
firefox-hu-91.12.0-1.mga8
firefox-bn-91.12.0-1.mga8
firefox-hi_IN-91.12.0-1.mga8
firefox-ar-91.12.0-1.mga8
firefox-sk-91.12.0-1.mga8
firefox-cs-91.12.0-1.mga8
firefox-ur-91.12.0-1.mga8
firefox-hsb-91.12.0-1.mga8
firefox-lt-91.12.0-1.mga8
firefox-te-91.12.0-1.mga8
firefox-fr-91.12.0-1.mga8
firefox-he-91.12.0-1.mga8
firefox-pl-91.12.0-1.mga8
firefox-sq-91.12.0-1.mga8
firefox-fa-91.12.0-1.mga8
firefox-de-91.12.0-1.mga8
firefox-oc-91.12.0-1.mga8
firefox-tr-91.12.0-1.mga8
firefox-kab-91.12.0-1.mga8
firefox-es_MX-91.12.0-1.mga8
firefox-es_AR-91.12.0-1.mga8
firefox-es_CL-91.12.0-1.mga8
firefox-pt_PT-91.12.0-1.mga8
firefox-fy_NL-91.12.0-1.mga8
firefox-pt_BR-91.12.0-1.mga8
firefox-gl-91.12.0-1.mga8
firefox-cy-91.12.0-1.mga8
firefox-sv_SE-91.12.0-1.mga8
firefox-gd-91.12.0-1.mga8
firefox-km-91.12.0-1.mga8
firefox-ro-91.12.0-1.mga8
firefox-mr-91.12.0-1.mga8
firefox-gu_IN-91.12.0-1.mga8
firefox-hr-91.12.0-1.mga8
firefox-sl-91.12.0-1.mga8
firefox-nl-91.12.0-1.mga8
firefox-es_ES-91.12.0-1.mga8
firefox-eo-91.12.0-1.mga8
firefox-ca-91.12.0-1.mga8
firefox-da-91.12.0-1.mga8
firefox-fi-91.12.0-1.mga8
firefox-eu-91.12.0-1.mga8
firefox-ia-91.12.0-1.mga8
firefox-nn_NO-91.12.0-1.mga8
firefox-nb_NO-91.12.0-1.mga8
firefox-br-91.12.0-1.mga8
firefox-id-91.12.0-1.mga8
firefox-tl-91.12.0-1.mga8
firefox-my-91.12.0-1.mga8
firefox-ta-91.12.0-1.mga8
firefox-en_GB-91.12.0-1.mga8
firefox-szl-91.12.0-1.mga8
firefox-en_CA-91.12.0-1.mga8
firefox-an-91.12.0-1.mga8
firefox-ast-91.12.0-1.mga8
firefox-kn-91.12.0-1.mga8
firefox-az-91.12.0-1.mga8
firefox-si-91.12.0-1.mga8
firefox-en_US-91.12.0-1.mga8
firefox-et-91.12.0-1.mga8
firefox-ff-91.12.0-1.mga8
firefox-lij-91.12.0-1.mga8
firefox-uz-91.12.0-1.mga8
firefox-is-91.12.0-1.mga8
firefox-mk-91.12.0-1.mga8
firefox-lv-91.12.0-1.mga8
firefox-bs-91.12.0-1.mga8
firefox-ga_IE-91.12.0-1.mga8
firefox-it-91.12.0-1.mga8
firefox-ms-91.12.0-1.mga8
firefox-xh-91.12.0-1.mga8
firefox-af-91.12.0-1.mga8

from SRPMS:
nss-3.81.0-1.mga8.src.rpm
firefox-91.12.0-1.mga8.src.rpm
firefox-l10n-91.12.0-1.mga8.src.rpm
Comment 1 David Walser 2022-07-25 21:44:39 CEST
Copy-paste error in Comment 0.  There is an nss update, but not rootcerts.

Updates have been submitted to the build system and should be available by the end of the day.

Assignee: luigiwalser => qa-bugs

Comment 2 Herman Viaene 2022-07-26 09:29:16 CEST
The following package has to be removed for others to be upgraded:
lib64openssl-static-devel-1.1.1q-1.mga8.x86_64
 (due to conflicts with lib64nss-static-devel-3.81.0-1.mga8.x86_64)

CC: (none) => herman.viaene

Comment 3 Herman Viaene 2022-07-26 10:10:55 CEST
MGA8-64 Plasma on Acer Aspire 5253
No installation issues apart from the niggle in Comment 2.
Running usual newspaper site and beloved manamana on youtube  and editing here shows no problems.
Comment 4 Jose Manuel López 2022-07-26 13:06:20 CEST
Mageia 8 Plasma X86_64. No installations issues. Banks, addons, settings, language es-ES, video and audio ok. Works fine for me.

CC: (none) => joselp

Comment 5 David Walser 2022-07-26 17:45:48 CEST
Security issues fixed:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-29/

Advisory:
========================

Updated firefox packages fix security vulnerabilities:

When visiting directory listings for chrome:// URLs as source text, some
parameters were reflected (CVE-2022-36318).

When combining CSS properties for overflow and transform, the mouse cursor could
interact with different coordinates than displayed (CVE-2022-36319).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36318
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36319
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/jYrL4b47r3A
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_81.html
https://www.mozilla.org/en-US/security/advisories/mfsa2022-29/

Severity: critical => major

Comment 6 Dave Hodgins 2022-07-26 17:49:15 CEST
(In reply to Herman Viaene from comment #2)
> The following package has to be removed for others to be upgraded:
> lib64openssl-static-devel-1.1.1q-1.mga8.x86_64
>  (due to conflicts with lib64nss-static-devel-3.81.0-1.mga8.x86_64)

That's normal. Allow it. Most people will not have the devel libs installed.

CC: (none) => davidwhodgins

Comment 7 Morgan Leijström 2022-07-26 18:15:59 CEST
Selecting Firefox in drakrpm, correctly libnss is selected too.
But should not also nss be autoselected, by libnss version?

CC: (none) => fri

Comment 8 David Walser 2022-07-26 19:09:50 CEST
No, you always need to make sure all relevant updates are selected when testing.  They won't always automatically.  It's not an issue once updates are pushed because you just install all available updates.
Comment 9 Morgan Leijström 2022-07-26 19:21:17 CEST
Well for normal cases yes.
We could also say that for libnss.

There is a irrergularity that libnss is a dep of ff but not nss of libnss.
Comment 10 David Walser 2022-07-26 19:26:33 CEST
It is a dependency, just not all the way down to the version-release level.  That's common among subpackages, as too tight dependencies can cause dependency loops and other issues that cause upgrade problems.
Comment 11 Morgan Leijström 2022-07-26 23:47:44 CEST
mga8-64 OK
Plasma, nvidia-current, 4k screen, i7
Localisation Swedish
Restored saved tabs
Plugins I have seem OK
Browsing some sites with video and different logins
No regression noted.
Comment 12 Brian Rockwell 2022-07-28 21:45:04 CEST
MGA8-64, Gnome, Asus Laptop

AMD A6-9225 RADEON R4
RTL8723BE 
Bluetooth

The following 6 packages are going to be installed:

- firefox-91.12.0-1.mga8.x86_64
- firefox-en_CA-91.12.0-1.mga8.noarch
- firefox-en_GB-91.12.0-1.mga8.noarch
- firefox-en_US-91.12.0-1.mga8.noarch
- lib64nss3-3.81.0-1.mga8.x86_64
- nss-3.81.0-1.mga8.x86_64



---- restarted system

I've used it on my favorite websites (video/audio/text) - no issues

CC: (none) => brtians1

David Walser 2022-07-29 17:34:33 CEST

Blocks: (none) => 30681

Comment 13 Dave Hodgins 2022-07-29 19:22:52 CEST
No regressions noticed. Validating the update.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs
Whiteboard: (none) => MGA8-64-OK

Dave Hodgins 2022-07-29 20:35:38 CEST

Keywords: (none) => advisory

Comment 14 Mageia Robot 2022-07-29 22:54:52 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0271.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 15 David Walser 2022-07-30 18:31:08 CEST
I've been told that the nss update wasn't pushed.

Resolution: FIXED => (none)
Status: RESOLVED => REOPENED

Comment 16 Morgan Leijström 2022-07-30 18:51:31 CEST
Per msg on dev list 11 hours ago tmb moved it, and later a user responded it worked.

Resolution: (none) => FIXED
Status: REOPENED => RESOLVED

Comment 17 David Walser 2022-08-01 17:07:17 CEST
RedHat has issued an advisory for this today (August 1):
https://access.redhat.com/errata/RHSA-2022:5767

Note You need to log in before you can comment on or make changes to this bug.