SUSE-SU-2024:0228-1: Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955): CVE-2024-0741: Out of bounds write in ANGLE CVE-2024-0742: Failure to update user input timestamp CVE-2024-0746: Crash when listing printers on Linux CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set CVE-2024-0749: Phishing site popup could show local origin in address bar CVE-2024-0750: Potential permissions request bypass via clickjacking CVE-2024-0751: Privilege escalation through devtools CVE-2024-0753: HSTS policy on subdomain could bypass policy of upper domain CVE-2024-0755: Memory safety bugs fixed in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
suse/MozillaFirefox-debugsourceto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade
suse/MozillaFirefox-debuginfoto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade
suse/MozillaFirefoxto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade
suse/MozillaFirefox-translations-commonto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade
suse/MozillaFirefox-translations-otherto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade
suse/MozillaFirefox-develto a version that resolves this vulnerability.Fixed in 115.7.0-150000.150.122.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP1-LTSS-2024-228=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP1-LTSS-2024-228=1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP1-2024-228=1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems and packages are covered by this advisory?
The advisory applies to MozillaFirefox and related debug, development, and translation packages on SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS for aarch64, x86_64, and noarch packages.
Are any of the listed issues tied to specific browser features or policies?
One Content Security Policy issue applies when the unsafe-inline directive is set. The update also lists a privilege-escalation issue through developer tools, as well as issues involving printer listing on Linux, permissions prompts, HSTS handling, and address-bar display.
What update level resolves the listed Firefox issues?
The advisory updates Firefox Extended Support Release to 115.7.0 ESR and includes fixes for the listed CVEs. No alternative mitigations are provided in the advisory.