Updates have been submitted to the build system and should be available by the end of the day.

Security issues fixed:
https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/

Advisory:
========================

Updated firefox packages fix security vulnerabilities:

An attacker who compromised a content process could have partially escaped the
sandbox to read arbitrary files via clipboard-related IPC messages
(CVE-2022-46872).

A drag-and-dropped file with a long filename could have had its filename
truncated to remove the valid extension, leaving a malicious extension in its
place. This could potentially led to user confusion and the execution of
malicious code (CVE-2022-46874).

Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla
Fuzzing Team reported memory safety bugs present in Firefox ESR 102.5. Some of
these bugs showed evidence of memory corruption and we presume that with
enough effort some of these could have been exploited to run arbitrary code
(CVE-2022-46878).

A missing check related to tex units could have led to a use-after-free in
WebGL and potentially exploitable crash (CVE-2022-46880).

An optimization in WebGL was incorrect in some cases, and could have led to
memory corruption and a potentially exploitable crash (CVE-2022-46881).

A use-after-free in WebGL extensions could have led to a potentially
exploitable crash (CVE-2022-46882).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46872
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46874
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46878
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46880
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46881
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46882
https://groups.google.com/a/mozilla.org/g/dev-tech-crypto/c/NqCkaX216zY
https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_86.html
https://www.mozilla.org/en-US/security/advisories/mfsa2022-52/

Assignee: luigiwalser => qa-bugs

mga8-64 OK for me

Plasma, i7-3770, GM107 [GeForce GTX 750] using nvidia-current; GeForce 635 series and later, 4k display.

Updated to:
- firefox-102.6.0-1.mga8.x86_64
- firefox-sv_SE-102.6.0-1.mga8.noarch
- lib64nss3-3.86.0-1.mga8.x86_64
- nss-3.86.0-1.mga8.x86_64

Tested various banking, authority, shops, different login methods, video sites.
Swedish locale.


__Still not fixed__
The about box still say "mageia - 1.0"

CC: (none) => fri

Hi all,

Installed in Mga 8 Plasma in two computers, no issues for the moment.

Banks ok.
Settings ok.
Audio and video ok.
Spanish translation ok.
Addons ok.

Right now, writing for this new version.

Only as comment 2. The about box still say "mageia - 1.0"

CC: (none) => joselp

MGA8 XFCE 64 with nvidia graphic card

updated with QA repo and RPMs: 

firefox                        102.6.0      1.mga8        x86_64  
firefox-fr                     102.6.0      1.mga8        noarch  
lib64nss3                      3.86.0       1.mga8        x86_64  
nss                            3.86.0       1.mga8        x86_64  

No issues after installation:

Audio and Vidéo OK (Spotify and Netflix)
Bank sites OK
Matrix web client OK

CC: (none) => guillaume.royer

RedHat has issued an advisory for this today (December 15):
https://access.redhat.com/errata/RHSA-2022:9067

MGA8-64 Plasma system, i5-2500, Intel graphics, wired Internet.

Updated the US English versions of Firefox and Thunderbird at the same time, and have been using them off and on for nearly four hours with no issues to report.

CC: (none) => andrewsfarm

MGA8-64 Plasma system, HP Pavilion 15, AMD A8-4555, AMD "Aruba" graphics, rtl8818EE wifi. 

Updated Firefox and Thunderbird at the same time, read my morning newspaper, checked tracking of a package, making this report, all OK.

Tested with Canadian English, and with French.
Validating. Advisory committed to svn.

Keywords: (none) => advisory, validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => davidwhodgins, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2022-0475.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED

- Bug 1803453 - Set CKA_NSS_SERVER_DISTRUST_AFTER and
CKA_NSS_EMAIL_DISTRUST_AFTER for 3 TrustCor Root Certificates.

from this nss update is CVE-2022-23491:
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPGIG3RLJJT2HMZS76SNGJZMTWOTMFUX/

So that was fixed in this update too.