Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 115.4.0 ESR.
Security Fix(es):
* Mozilla: Queued up rendering could have allowed websites to clickjack (CVE-2023-5721)
* Mozilla: Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4 (CVE-2023-5730)
* libvpx: crash related to VP9 encoding in libvpx (CVE-2023-44488)
* Mozilla: Large WebGL draw could have led to a crash (CVE-2023-5724)
* Mozilla: WebExtensions could open arbitrary URLs (CVE-2023-5725)
* Mozilla: Improper object tracking during GC in the JavaScript engine could have led to a crash. (CVE-2023-5728)
* Mozilla: Address bar spoofing via bidirectional characters (CVE-2023-5732)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | firefox | 115.4.0-1.el9_2.alma.1 |
| AlmaLinux · 9 | firefox-x11 | 115.4.0-1.el9_2.alma.1 |
Vulnerabilities 7
-
High 7.5
Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. …
-
High 7.5
During garbage collection extra operations were performed on a object that should not be. This could have led to a pote…
-
Unscored —
VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
-
Unscored —
It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to…
-
Unscored —
A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to …
-
Unscored —
Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. Some of these bugs showed evidence…
-
Unscored —
Address bar spoofing via bidirectional characters
An attacker could have created a malicious link using bidirectional characters to spoof the location in the address bar when visited. This vulnerability affects Firefox < 117, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
References
-
report
https://access.redhat.com/security/cve/CVE-2023-44488
-
report
https://access.redhat.com/security/cve/CVE-2023-5721
-
report
https://access.redhat.com/security/cve/CVE-2023-5724
-
report
https://access.redhat.com/security/cve/CVE-2023-5725
-
report
https://access.redhat.com/security/cve/CVE-2023-5728
-
report
https://access.redhat.com/security/cve/CVE-2023-5730
-
report
https://access.redhat.com/security/cve/CVE-2023-5732
-
report
https://bugzilla.redhat.com/2241806
-
report
https://bugzilla.redhat.com/2245896
-
report
https://bugzilla.redhat.com/2245898
-
report
https://bugzilla.redhat.com/2245899
-
report
https://bugzilla.redhat.com/2245900
-
report
https://bugzilla.redhat.com/2245903
-
report
https://bugzilla.redhat.com/2245906
-
advisory
https://errata.almalinux.org/9/ALSA-2023-6188.html