Summary
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.8.0 ESR (bsc#1197903):
MFSA 2022-14 (bsc#1197903)
* CVE-2022-1097: Fixed memory safety violations that could occur when PKCS#11 tokens are removed while in use
* CVE-2022-28281: Fixed an out of bounds write due to unexpected WebAuthN Extensions
* CVE-2022-1196: Fixed a use-after-free after VR Process destruction
* CVE-2022-28282: Fixed a use-after-free in DocumentL10n::TranslateDocument
* CVE-2022-28285: Fixed incorrect AliasSet used in JIT Codegen
* CVE-2022-28286: Fixed that iframe contents could be rendered outside the border
* CVE-2022-24713: Fixed a denial of service via complex regular expressions
* CVE-2022-28289: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| SUSE · SLES 11 SP4 Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 91.8.0-78.170.1 |
Vulnerabilities 8
-
High 8.8CVE-2022-28281 Public exploit
If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…
-
High 8.8
Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team …
-
High 7.5
Regular expression denial of service in Rust's regex crate
regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations…
-
Medium 6.5
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on diffe…
-
Medium 6.5
After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and pot…
-
Medium 6.5
By using a link with <code>rel="localization"</code> a use-after-free could have been triggered by destroying an object…
-
Medium 6.5
When generating the assembly code for <code>MLoadTypedArrayElementHole</code>, an incorrect AliasSet was used. In conju…
-
Medium 5.4
Due to a layout change, iframe contents could have been rendered outside of its border. This could have led to user con…
References
-
report
https://bugzilla.suse.com/1197903
-
web
https://www.suse.com/security/cve/CVE-2022-1097
-
web
https://www.suse.com/security/cve/CVE-2022-1196
-
web
https://www.suse.com/security/cve/CVE-2022-24713
-
web
https://www.suse.com/security/cve/CVE-2022-28281
-
web
https://www.suse.com/security/cve/CVE-2022-28282
-
web
https://www.suse.com/security/cve/CVE-2022-28285
-
web
https://www.suse.com/security/cve/CVE-2022-28286
-
web
https://www.suse.com/security/cve/CVE-2022-28289