SUSE-SU-2024:0211-1: Security update for MozillaFirefox

Q: Which SUSE environments are identified as receiving this update?

The listed affected environments are SUSE Linux Enterprise Software Development Kit 12 SP5 on aarch64, ppc64le, s390x, and x86_64, plus its noarch packages, and SUSE Linux Enterprise High Performance Computing 12 SP5 on aarch64 and x86_64.

Q: Which installed packages should be included when applying the update?

The update lists MozillaFirefox along with mozillafirefox-debugsource, mozillafirefox-debuginfo, mozillafirefox-devel, and mozillafirefox-translations-common. The advisory updates Firefox to ESR 115.7.0.

Q: What types of security impact are addressed by this update?

The listed issues include an out-of-bounds write in ANGLE, content security policy bypass, phishing-related address-bar origin spoofing, clickjacking-related permissions bypass, developer-tools privilege escalation, HSTS policy bypass, and memory-safety bugs. It also fixes a crash that can occur when listing printers on Linux.

Published Jan 24, 2024

Updated

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7

Affected Software

26 affected componentsFixes available

All of the following

SUSE SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/mozillafirefox-debugsource<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debuginfo<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise Software Development Kit 12 SP5 (noarch)

suse/mozillafirefox-devel<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)

Any of the following

suse/mozillafirefox-translations-common<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debugsource<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debuginfo<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch)

suse/mozillafirefox-devel<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/mozillafirefox-translations-common<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debugsource<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debuginfo<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise Server 12 SP5 (noarch)

suse/mozillafirefox-devel<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)

Any of the following

suse/mozillafirefox-translations-common<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debugsource<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox<115.7.0-112.197.1

115.7.0-112.197.1

suse/mozillafirefox-debuginfo<115.7.0-112.197.1

115.7.0-112.197.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch)

suse/mozillafirefox-devel<115.7.0-112.197.1

115.7.0-112.197.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/MozillaFirefox-debugsource to a version that resolves this vulnerability.
Fixed in 115.7.0-112.197.1
Upgrade
Upgrade suse/MozillaFirefox-debuginfo to a version that resolves this vulnerability.
Fixed in 115.7.0-112.197.1
Upgrade
Upgrade suse/MozillaFirefox-devel to a version that resolves this vulnerability.
Fixed in 115.7.0-112.197.1
Upgrade
Upgrade suse/MozillaFirefox-translations-common to a version that resolves this vulnerability.
Fixed in 115.7.0-112.197.1
Upgrade
Upgrade suse/MozillaFirefox to a version that resolves this vulnerability.
Fixed in 115.7.0-112.197.1
Upgrade
Upgrade MozillaFirefox to a version that resolves this vulnerability.
Fixed in 115.7.0 ESR

Event History

Jan 24, 2024

Advisory Published

via SUSE·04:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which SUSE environments are identified as receiving this update?

The listed affected environments are SUSE Linux Enterprise Software Development Kit 12 SP5 on aarch64, ppc64le, s390x, and x86_64, plus its noarch packages, and SUSE Linux Enterprise High Performance Computing 12 SP5 on aarch64 and x86_64.

Which installed packages should be included when applying the update?

The update lists MozillaFirefox along with mozillafirefox-debugsource, mozillafirefox-debuginfo, mozillafirefox-devel, and mozillafirefox-translations-common. The advisory updates Firefox to ESR 115.7.0.

What types of security impact are addressed by this update?

The listed issues include an out-of-bounds write in ANGLE, content security policy bypass, phishing-related address-bar origin spoofing, clickjacking-related permissions bypass, developer-tools privilege escalation, HSTS policy bypass, and memory-safety bugs. It also fixes a crash that can occur when listing printers on Linux.

SUSE-SU-2024:0211-1: Security update for MozillaFirefox

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which SUSE environments are identified as receiving this update?

Which installed packages should be included when applying the update?

What types of security impact are addressed by this update?

Company

Resources

Contact

Frequently Asked Questions

Which SUSE environments are identified as receiving this update?

Which installed packages should be included when applying the update?

What types of security impact are addressed by this update?