Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 91.6.0 ESR.
Security Fix(es):
* Mozilla: Extensions could have bypassed permission confirmation during update (CVE-2022-22754)
* Mozilla: Memory safety bugs fixed in Firefox 97 and Firefox ESR 91.6 (CVE-2022-22764)
* Mozilla: Drag and dropping an image could have resulted in the dropped object being an executable (CVE-2022-22756)
* Mozilla: Sandboxed iframes could have executed script if the parent appended elements (CVE-2022-22759)
* Mozilla: Cross-Origin responses could be distinguished between script and non-script content-types (CVE-2022-22760)
* Mozilla: frame-ancestors Content Security Policy directive was not enforced for framed extension pages (CVE-2022-22761)
* Mozilla: Script Execution during invalid object state (CVE-2022-22763)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | firefox | 91.6.0-1.el8_5.alma |
Vulnerabilities 7
-
Critical 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to th…
-
High 8.8
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have bee…
-
High 8.8
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …
-
High 8.8
When a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it shou…
-
High 8.8
Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firef…
-
Medium 6.5
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…
-
Medium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…
References
-
report
https://vulners.com/cve/CVE-2022-22754
-
report
https://vulners.com/cve/CVE-2022-22756
-
report
https://vulners.com/cve/CVE-2022-22759
-
report
https://vulners.com/cve/CVE-2022-22760
-
report
https://vulners.com/cve/CVE-2022-22761
-
report
https://vulners.com/cve/CVE-2022-22763
-
report
https://vulners.com/cve/CVE-2022-22764