openSUSE-SU-2022:1127-1
See a problem?- Import Source
- https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2022:1127-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/openSUSE-SU-2022:1127-1
- Related
- Published
- 2022-04-07T15:04:04Z
- Modified
- 2022-04-07T15:04:04Z
- Summary
- Security update for MozillaFirefox
- Details
-
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 91.8.0 ESR (bsc#1197903):
MFSA 2022-14 (bsc#1197903)
- CVE-2022-1097: Fixed memory safety violations that could occur when PKCS#11 tokens are removed while in use
- CVE-2022-28281: Fixed an out of bounds write due to unexpected WebAuthN Extensions
- CVE-2022-1196: Fixed a use-after-free after VR Process destruction
- CVE-2022-28282: Fixed a use-after-free in DocumentL10n::TranslateDocument
- CVE-2022-28285: Fixed incorrect AliasSet used in JIT Codegen
- CVE-2022-28286: Fixed that iframe contents could be rendered outside the border
- CVE-2022-24713: Fixed a denial of service via complex regular expressions
- CVE-2022-28289: Memory safety bugs fixed in Firefox 99 and Firefox ESR 91.8
The following non-security bugs were fixed:
- Adjust rust dependency for SP3 and later. TW uses always the newest version of rust, but we don't, so we can't use the rust+cargo notation, which would need both < and >= requirements. (bsc#1197698)
- References
-
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/76BLKP3BHKRBWFX4VJKKQJQXQTYEOOSX/
- https://bugzilla.suse.com/1197698
- https://bugzilla.suse.com/1197903
- https://www.suse.com/security/cve/CVE-2022-1097
- https://www.suse.com/security/cve/CVE-2022-1196
- https://www.suse.com/security/cve/CVE-2022-24713
- https://www.suse.com/security/cve/CVE-2022-28281
- https://www.suse.com/security/cve/CVE-2022-28282
- https://www.suse.com/security/cve/CVE-2022-28285
- https://www.suse.com/security/cve/CVE-2022-28286
- https://www.suse.com/security/cve/CVE-2022-28289
Affected packages
openSUSE:Leap 15.3 / MozillaFirefox
Package
- Name
- MozillaFirefox
- Purl
- pkg:rpm/opensuse/MozillaFirefox&distro=openSUSE%20Leap%2015.3
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed91.8.0-150200.152.26.1
Ecosystem specific
{
"binaries": [
{
"MozillaFirefox": "91.8.0-150200.152.26.1",
"MozillaFirefox-translations-common": "91.8.0-150200.152.26.1",
"MozillaFirefox-devel": "91.8.0-150200.152.26.1",
"MozillaFirefox-translations-other": "91.8.0-150200.152.26.1",
"MozillaFirefox-branding-upstream": "91.8.0-150200.152.26.1"
}
]
}