Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 102.3.0 ESR.
Security Fix(es):
* Mozilla: Bypassing FeaturePolicy restrictions on transient pages (CVE-2022-40959)
* Mozilla: Data-race when parsing non-UTF-8 URLs in threads (CVE-2022-40960)
* Mozilla: Memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962)
* Mozilla: Bypassing Secure Context restriction for cookies with __Host and __Secure prefix (CVE-2022-40958)
* Mozilla: Content-Security-Policy base-uri bypass (CVE-2022-40956)
* Mozilla: Incoherent instruction cache when building WASM on ARM64 (CVE-2022-40957)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | firefox | 102.3.0-6.el8_6.alma |
Vulnerabilities 6
-
High 8.8
Mozilla developers Nika Layzell, Timothy Nikkel, Sebastian Hengst, Andreas Pehrson, and the Mozilla Fuzzing Team report…
-
Medium 6.5
Inconsistent data in instruction and data cache when creating wasm code could lead to a potentially exploitable crash.<…
-
Medium 6.5
By injecting a cookie with certain special characters, an attacker on a shared subdomain which is not a secure context …
-
Medium 6.5
During iframe navigation, certain pages did not have their FeaturePolicy fully initialized leading to a bypass that lea…
-
Medium 6.5
Concurrent use of the URL parser with non-UTF-8 data was not thread-safe. This could lead to a use-after-free causing a…
-
Medium 6.1
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected ele…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-40956
-
report
https://access.redhat.com/security/cve/CVE-2022-40957
-
report
https://access.redhat.com/security/cve/CVE-2022-40958
-
report
https://access.redhat.com/security/cve/CVE-2022-40959
-
report
https://access.redhat.com/security/cve/CVE-2022-40960
-
report
https://access.redhat.com/security/cve/CVE-2022-40962
-
report
https://bugzilla.redhat.com/2128792
-
report
https://bugzilla.redhat.com/2128793
-
report
https://bugzilla.redhat.com/2128794
-
report
https://bugzilla.redhat.com/2128795
-
report
https://bugzilla.redhat.com/2128796
-
report
https://bugzilla.redhat.com/2128797
-
advisory
https://errata.almalinux.org/8/ALSA-2022-6702.html