Summary
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.9.0 ESR
MFSA 2022-17 (bsc#1198970)
* CVE-2022-29914: Fullscreen notification bypass using popups
* CVE-2022-29909: Bypassing permission prompt in nested browsing contexts
* CVE-2022-29916: Leaking browser history with CSS variables
* CVE-2022-29911: iframe Sandbox bypass
* CVE-2022-29912: Reader mode bypassed SameSite cookies
* CVE-2022-29917: Memory safety bugs fixed in Firefox 100 and Firefox ESR 91.9
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| SUSE · Enterprise Storage 7 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| openSUSE · Leap 15.3 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| openSUSE · Leap 15.4 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLE HPC 15 SP2 Linux Enterprise High Performance Computing 15 SP2-ESPOS | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLE HPC 15 SP2 Linux Enterprise High Performance Computing 15 SP2-LTSS | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLES 15 SP3 Linux Enterprise Module for Desktop Applications 15 SP3 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLES 15 SP4 Linux Enterprise Module for Desktop Applications 15 SP4 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLES 15 SP2 Linux Enterprise Server 15 SP2-BCL | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLES 15 SP2 Linux Enterprise Server 15 SP2-LTSS | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · SLES for SAP 15 SP2 Linux Enterprise Server for SAP Applications 15 SP2 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · Manager Proxy 4.1 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · Manager Retail Branch Server 4.1 | MozillaFirefox | 91.9.0-150200.152.33.1 |
| SUSE · Manager Server 4.1 | MozillaFirefox | 91.9.0-150200.152.33.1 |
Vulnerabilities 6
-
Critical 9.8
Mozilla developers Andrew McCreight, Gabriele Svelto, Tom Ritter and the Mozilla Fuzzing Team reported memory safety bu…
-
High 8.8
Documents in deeply-nested cross-origin browsing contexts could have obtained permissions granted to the top-level orig…
-
Medium 6.5
When reusing existing popups Firefox would have allowed them to cover the fullscreen notification UI, which could have …
-
Medium 6.5
Firefox behaved slightly differently for already known resources when loading CSS resources involving CSS variables. Th…
-
Medium 6.1
An improper implementation of the new iframe sandbox keyword <code>allow-top-navigation-by-user-activation</code> could…
-
Medium 6.1
Requests initiated through reader mode did not properly omit cookies with a SameSite attribute. This vulnerability affe…
References
-
report
https://bugzilla.suse.com/1198970
-
web
https://www.suse.com/security/cve/CVE-2022-29909
-
web
https://www.suse.com/security/cve/CVE-2022-29911
-
web
https://www.suse.com/security/cve/CVE-2022-29912
-
web
https://www.suse.com/security/cve/CVE-2022-29914
-
web
https://www.suse.com/security/cve/CVE-2022-29916
-
web
https://www.suse.com/security/cve/CVE-2022-29917