Summary
TODO: add package description
This update upgrades Firefox to version 102.14.0 ESR.
Security Fix(es):
* Mozilla: Offscreen Canvas could have bypassed cross-origin restrictions (CVE-2023-4045)
* Mozilla: Incorrect value used during WASM compilation (CVE-2023-4046)
* Mozilla: Potential permissions request bypass via clickjacking (CVE-2023-4047)
* Mozilla: Crash in DOMParser due to out-of-memory conditions (CVE-2023-4048)
* Mozilla: Fix potential race conditions when releasing platform objects (CVE-2023-4049)
* Mozilla: Stack buffer overflow in StorageManager (CVE-2023-4050)
* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and Thunderbird 102.14 (CVE-2023-4056)
* Mozilla: Memory safety bugs fixed in Firefox 116, Firefox ESR 115.1, and Thunderbird 115.1 (CVE-2023-4057)
* Mozilla: Cookie jar overflow caused unexpected cookie jar state (CVE-2023-4055)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | firefox | 102.14.0-1.el8_8.alma |
Vulnerabilities 9
-
Unscored —
Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from ano…
-
Unscored —
In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. This resulted in …
-
Unscored —
A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into grantin…
-
Unscored —
An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.…
-
Unscored —
Race conditions in reference counting code were found through code inspection. These could have resulted in potentially…
-
Unscored —CVE-2023-4050 EPSS 13%
In some cases, an untrusted input stream was copied to a stack buffer without checking its size. This resulted in a pot…
-
Unscored —
When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no …
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 10…
-
Unscored —
Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. Some of these bugs showed evidence…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-4045
-
report
https://access.redhat.com/security/cve/CVE-2023-4046
-
report
https://access.redhat.com/security/cve/CVE-2023-4047
-
report
https://access.redhat.com/security/cve/CVE-2023-4048
-
report
https://access.redhat.com/security/cve/CVE-2023-4049
-
report
https://access.redhat.com/security/cve/CVE-2023-4050
-
report
https://access.redhat.com/security/cve/CVE-2023-4055
-
report
https://access.redhat.com/security/cve/CVE-2023-4056
-
report
https://access.redhat.com/security/cve/CVE-2023-4057
-
report
https://bugzilla.redhat.com/2228360
-
report
https://bugzilla.redhat.com/2228361
-
report
https://bugzilla.redhat.com/2228362
-
report
https://bugzilla.redhat.com/2228363
-
report
https://bugzilla.redhat.com/2228364
-
report
https://bugzilla.redhat.com/2228365
-
report
https://bugzilla.redhat.com/2228367
-
report
https://bugzilla.redhat.com/2228370
-
report
https://bugzilla.redhat.com/2228371
-
advisory
https://errata.almalinux.org/8/ALSA-2023-4468.html