Red Hat Security Advisory: firefox security update

Fixed packages 9

Vulnerabilities 8

• High 8.1
  CVE-2024-1553

  Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7. Some of these bugs showed evidence…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• High 7.5
  CVE-2024-1546

  When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in …

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• High 7.5
  CVE-2024-1552

  Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* Thi…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• Medium 6.5
  CVE-2024-1547

  Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another w…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• Medium 6.1
  CVE-2024-1549

  If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potent…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• Medium 6.1
  CVE-2024-1550

  A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• Medium 6.1
  CVE-2024-1551

  Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control th…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024
• Medium 4.3
  CVE-2024-1548

  A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led…

  Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  Feb 20, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265350
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265351
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265352
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265355
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2265356
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0971.json
• report
  https://access.redhat.com/security/cve/CVE-2024-1546
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1546
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1546
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1546
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/#CVE-2024-1546
• report
  https://access.redhat.com/security/cve/CVE-2024-1547
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1547
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1547
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1547
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/#CVE-2024-1547
• report
  https://access.redhat.com/security/cve/CVE-2024-1548
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1548
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1548
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1548
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/#CVE-2024-1548
• report
  https://access.redhat.com/security/cve/CVE-2024-1549
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1549
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1549
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1549
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/#CVE-2024-1549
• report
  https://access.redhat.com/security/cve/CVE-2024-1550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1550
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1550
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-07/#CVE-2024-1550
• report
  https://access.redhat.com/security/cve/CVE-2024-1551
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1551
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1551
• article
  https://www.mozilla.org/en-US/security/advisories/mfsa2024-06/#CVE-2024-1551