Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 91.8.0 ESR.
Security Fix(es):
* Mozilla: Use-after-free in NSSToken objects (CVE-2022-1097)
* Mozilla: Out of bounds write due to unexpected WebAuthN Extensions (CVE-2022-28281)
* Mozilla: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8 (CVE-2022-28289)
* Mozilla: Use-after-free after VR Process destruction (CVE-2022-1196)
* Mozilla: Use-after-free in DocumentL10n::TranslateDocument (CVE-2022-28282)
* Mozilla: Incorrect AliasSet used in JIT Codegen (CVE-2022-28285)
* Mozilla: Denial of Service via complex regular expressions (CVE-2022-24713)
* Mozilla: iframe contents could be rendered outside the border (CVE-2022-28286)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | firefox | 0:91.8.0-1.el8_5 |
Vulnerabilities 8
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072559
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072560
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072561
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072562
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072563
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072564
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072565
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2072566