ELSA-2022-0824 — Critical: firefox security and bug fix update (Oracle Linux 7)

Summary

[91.7.0-3.0.1]
- Remove upstream references [Orabug: 30143292]
- Update distribution for Oracle Linux [Orabug: 30143292]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
- Enabled aarch64 build

[91.7.0-3]
- Update to 91.7.0 build3

[91.7.0-2]
- Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315

[91.7.0-1]
- Update to 91.7.0 build2

[91.6.0-2]
- Install langpacks to the browser/extensions to make them available in UI:
rhbz#2030190

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 7	firefox	0:91.7.0-3.0.1.el7_9

Vulnerabilities 10

Critical 9.6

CVE-2022-26486 Exploited

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
KEV Mar 7, 2022
High 8.8

CVE-2022-26485 Exploited Public exploit EPSS 14%

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
KEV Mar 7, 2022
Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Critical 9.6

CVE-2022-26384

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-26381

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 7.5

CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.5

CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…

Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 4.3

CVE-2022-26383

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022

Critical: firefox security and bug fix update (Oracle Linux 7)

Summary

Fixed packages 1

Vulnerabilities 10

An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…