Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 115.5.0 ESR.
Security Fix(es):
* Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer (CVE-2023-6204)
* Mozilla: Use-after-free in MessagePort::Entangled (CVE-2023-6205)
* Mozilla: Clickjacking permission prompts using the fullscreen transition (CVE-2023-6206)
* Mozilla: Use-after-free in ReadableByteStreamQueueEntry::Buffer (CVE-2023-6207)
* Mozilla: Memory safety bugs fixed in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5 (CVE-2023-6212)
* Mozilla: Using Selection API would copy contents into X11 primary selection. (CVE-2023-6208)
* Mozilla: Incorrect parsing of relative URLs starting with "///" (CVE-2023-6209)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | firefox | 115.5.0-1.el8_9.alma.1 |
Vulnerabilities 7
-
Unscored —
On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak …
-
Unscored —
It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to …
-
Unscored —
The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission pro…
-
Unscored —
Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefo…
-
Unscored —
When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a …
-
Unscored —
Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could b…
-
Unscored —
Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence…
References
-
report
https://access.redhat.com/security/cve/CVE-2023-6204
-
report
https://access.redhat.com/security/cve/CVE-2023-6205
-
report
https://access.redhat.com/security/cve/CVE-2023-6206
-
report
https://access.redhat.com/security/cve/CVE-2023-6207
-
report
https://access.redhat.com/security/cve/CVE-2023-6208
-
report
https://access.redhat.com/security/cve/CVE-2023-6209
-
report
https://access.redhat.com/security/cve/CVE-2023-6212
-
report
https://bugzilla.redhat.com/2250896
-
report
https://bugzilla.redhat.com/2250897
-
report
https://bugzilla.redhat.com/2250898
-
report
https://bugzilla.redhat.com/2250899
-
report
https://bugzilla.redhat.com/2250900
-
report
https://bugzilla.redhat.com/2250901
-
report
https://bugzilla.redhat.com/2250902
-
advisory
https://errata.almalinux.org/8/ALSA-2023-7508.html