Summary
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 91.11 ESR.
Security Fix(es):
* Mozilla: CSP sandbox header without `allow-scripts` can be bypassed via retargeted javascript: URI (CVE-2022-34468)
* Mozilla: Use-after-free in nsSHistory (CVE-2022-34470)
* Mozilla: A popup window could be resized in a way to overlay the address bar with web content (CVE-2022-34479)
* Mozilla: Memory safety bugs fixed in Firefox 102 and Firefox ESR 91.11 (CVE-2022-34484)
* Mozilla: Undesired attributes could be set as part of prototype pollution (CVE-2022-2200)
* Mozilla: CSP bypass enabling stylesheet injection (CVE-2022-31744)
* Mozilla: Unavailable PAC file resulted in OCSP requests being blocked (CVE-2022-34472)
* Mozilla: Potential integer overflow in ReplaceElementsAt (CVE-2022-34481)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | firefox | 0:91.11.0-2.el8_6 |
Vulnerabilities 8
-
Critical 9.8
Session history navigations may have led to a use-after-free and potentially exploitable crash. This vulnerability affe…
-
High 8.8CVE-2022-2200 EPSS 24%
If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScr…
-
High 8.8
An iframe that was not permitted to run scripts could do so if the user clicked on a <code>javascript:</code> link. Thi…
-
High 8.8
In the <code>nsTArray_Impl::ReplaceElementsAt()</code> function, an integer overflow could have occurred when the numbe…
-
High 8.8
The Mozilla Fuzzing Team reported potential vulnerabilities present in Thunderbird 91.10. Some of these bugs showed evi…
-
Medium 6.5
An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so b…
-
Medium 6.5
A malicious website that could create a popup could have resized the popup to overlay the address bar with its own cont…
-
Medium 4.3
If there was a PAC URL set and the server that hosts the PAC was not reachable, OCSP requests would have been blocked, …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102161
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102162
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102163
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102164
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102165
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102166
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102168
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2102169