This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.7.0 ESR (MFSA 2024-02) (bsc#1218955):
- CVE-2024-0741: Out of bounds write in ANGLE
- CVE-2024-0742: Failure to update user input timestamp
- CVE-2024-0746: Crash when listing printers on Linux
- CVE-2024-0747: Bypass of Content Security Policy when directive unsafe-inline was set
- CVE-2024-0749: Phishing site popup could show local origin in address bar
- CVE-2024-0750: Potential permissions request bypass via clickjacking
- CVE-2024-0751: Privilege escalation through devtools
- CVE-2024-0753: HSTS policy on subdomain could bypass
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 115.6.0 ESR changelog-entry (bsc#1217974)
* CVE-2023-6856: Heap-buffer-overflow affecting WebGL DrawElementsInstanced method with Mesa VM driver (bmo#1843782).
* CVE-2023-6857: Symlinks may resolve to smaller than expected buffers (bmo#1796023).
* CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791).
* CVE-2023-6859: Use-after-free in PR_GetIdentitiesLayer (bmo#1840144).
* CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture validation (bmo#1854669).
* CVE-2023-6861: Heap buffer overflow affected nsWin
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 115.5.0 ESR Placeholder changelog-entry (bsc#1217230)
* Fixed: Various security fixes and other quality improvements. MFSA 2023-46 (bsc#1216338)
* CVE-2023-5721: Queued up rendering could have allowed websites to clickjack
* CVE-2023-5732: Address bar spoofing via bidirectional characters
* CVE-2023-5724: Large WebGL draw could have led to a crash
* CVE-2023-5725: WebExtensions could open arbitrary URLs
* CVE-2023-5726: Full scr
This update for MozillaFirefox fixes the following issues:
- Updated to version 115.4.0 ESR (bsc#1216338).
- CVE-2023-5721: Fixed a potential clickjack via queued up
rendering.
- CVE-2023-5722: Fixed a cross-Origin size and header leakage.
- CVE-2023-5723: Fixed unexpected errors when handling invalid
cookie characters.
- CVE-2023-5724: Fixed a crash due to a large WebGL draw.
- CVE-2023-5725: Fixed an issue where WebExtensions could open
arbitrary URLs.
- CVE-2023-5726: Fixed an issue where fullscreen notifications would
be obscured by file the open dialog on macOS.
- CVE-2023-5727: Fixed a download protection
This update for MozillaFirefox fixes the following issues:
Mozilla Firefox ESR 115.3.1 ESR was released to fix a security issue:
- MFSA 2023-44 (bsc#1215814)
* CVE-2023-5217: Fixed a heap buffer overflow in libvpx
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.3.0 ESR (MFSA 2023-42, bsc#1215575):
Security fixes:
- CVE-2023-5168: Out-of-bounds write in FilterNodeD2D1 (bmo#1846683).
- CVE-2023-5169: Out-of-bounds write in PathOps (bmo#1846685).
- CVE-2023-5171: Use-after-free in Ion Compiler (bmo#1851599).
- CVE-2023-5174: Double-free in process spawning on Windows (bmo#1848454).
- CVE-2023-5176: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (bmo#1836353, bmo#1842674, bmo#1843824, bmo#1843962, bmo#1848890, bmo#1850180, bmo#1850983, bmo#1851195).
Other fixes
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 115.2.1 ESR (bsc#1215245).
- CVE-2023-4863: Fixed heap buffer overflow in libwebp (MFSA 2023-40) (bsc#1215231).
The following non-security bug was fixed:
- Fix i586 build by reducing debug info to -g1 (bsc#1210168).
This update for MozillaFirefox fixes the following issues:
Firefox was updated to Extended Support Release 115.2.0 ESR (MFSA 2023-36) (bsc#1214606).
- CVE-2023-4574: Fixed memory corruption in IPC ColorPickerShownCallback (bmo#1846688)
- CVE-2023-4575: Fixed memory corruption in IPC FilePickerShownCallback (bmo#1846689)
- CVE-2023-4576: Fixed integer Overflow in RecordedSourceSurfaceCreation (bmo#1846694)
- CVE-2023-4577: Fixed memory corruption in JIT UpdateRegExpStatics (bmo#1847397)
- CVE-2023-4051: Fixed full screen notification obscured by file open dialog (bmo#1821884)
- CVE-2023-4578: Fixed Out of Memory Exception in SpiderMonkey co
This update for MozillaFirefox fixes the following security issues:
Firefox was updated to Extended Support Release 115.1.0 ESR (bsc#1213746).
- CVE-2023-4045: Fixed cross-origin restrictions bypass with Offscreen Canvas (bmo#1833876).
- CVE-2023-4046: Fixed incorrect value used during WASM compilation (bmo#1837686).
- CVE-2023-4047: Fixed potential permissions request bypass via clickjacking (bmo#1839073).
- CVE-2023-4048: Fixed crash in DOMParser due to out-of-memory conditions (bmo#1841368).
- CVE-2023-4049: Fixed potential race conditions when releasing platform objects (bmo#1842658).
- CVE-2023-4050: Fixed stack buffer ov
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 115.0.2 ESR (MFSA 2023-26, bsc#1213230)
Security fixes:
- CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703)
Other fixes:
- Fixed a startup crash experienced by some Windows
users by blocking instances of a malicious injected DLL
(bmo#1841751)
- Fixed a bug with displaying a caret in the text editor
on some websites (bmo#1840804)
- Fixed a bug with broken audio rendering on some
websites (bmo#1841982)
- Fixed a bug with patternTransform translate using the
wrong units (bmo#1840746)
- Fixed a crash affecting Windows
Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
Changes in MozillaFirefox and MozillaFirefox-branding-SLE:
This update provides Firefox Extended Support Release 115.0 ESR
* New:
- Required fields are now highlighted in PDF forms.
- Improved performance on high-refresh rate monitors (120Hz+).
- Buttons in the Tabs toolbar can now be reached with Tab,
Shift+Tab, and Arrow keys. View this article for additional
details.
- Windows' 'Make text bigger' accessibility setting now
affects all the UI and content pages, rather than only
applying to system font sizes.
- Non-breaking s
This update for MozillaFirefox fixes the following issues:
Extended Support Release 102.12.0 ESR (bsc#1211922):
- CVE-2023-34414: Click-jacking certificate exceptions through rendering lag
- CVE-2023-34416: Memory safety bugs fixed in Firefox 114 and Firefox ESR 102.12
This update for MozillaFirefox fixes the following issues:
Extended Support Release 102.11.0 ESR (bsc#1211175):
- CVE-2023-32205: Browser prompts could have been obscured by popups
- CVE-2023-32206: Crash in RLBox Expat driver
- CVE-2023-32207: Potential permissions request bypass via clickjacking
- CVE-2023-32211: Content process crash due to invalid wasm code
- CVE-2023-32212: Potential spoof due to obscured address bar
- CVE-2023-32213: Potential memory corruption in FileReader::DoReadData()
- CVE-2023-32214: Potential DoS via exposed protocol handlers
- CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and Firefox ESR 102.11
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 102.10.0 ESR (bsc#1210212)
- CVE-2023-29531: Out-of-bound memory access in WebGL on macOS
- CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass
- CVE-2023-29533: Fullscreen notification obscured
- MFSA-TMP-2023-0001: Double-free in libwebp
- CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction
- CVE-2023-29536: Invalid free from JavaScript code
- CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download
- CVE-2023-29541: Files with malicious extensions could have been downloaded
This update for MozillaFirefox fixes the following issues:
Update to version 102.9.0 ESR (bsc#1209173):
- CVE-2023-28159: Fullscreen Notification could have been hidden by download popups on Android
- CVE-2023-25748: Fullscreen Notification could have been hidden by window prompts on Android
- CVE-2023-25749: Firefox for Android may have opened third-party apps without a prompt
- CVE-2023-25750: Potential ServiceWorker cache leak during private browsing mode
- CVE-2023-25751: Incorrect code generation during JIT compilation
- CVE-2023-28160: Redirect to Web Extension files may have leaked local path
- CVE-2023-28164: URL being dragged f
This update for MozillaFirefox fixes the following issues:
Updated to version 102.8.0 ESR (bsc#1208144):
- CVE-2023-25728: Fixed content security policy leak in violation reports using iframes.
- CVE-2023-25730: Fixed screen hijack via browser fullscreen mode.
- CVE-2023-25743: Fixed Fullscreen notification not being shown in Firefox Focus.
- CVE-2023-0767: Fixed arbitrary memory write via PKCS 12 in NSS.
- CVE-2023-25735: Fixed potential use-after-free from compartment mismatch in SpiderMonkey.
- CVE-2023-25737: Fixed invalid downcast in SVGUtils::SetupStrokeGeometry.
- CVE-2023-25738: Fixed printing on Windows which could
This update for MozillaFirefox fixes the following issues:
- Updated to version 102.7.0 ESR (bsc#1207119):
- CVE-2022-46871: Updated an out of date library (libusrsctp) which
contained several vulnerabilities.
- CVE-2023-23598: Fixed an arbitrary file read from GTK drag and
drop on Linux.
- CVE-2023-23601: Fixed a potential spoofing attack when dragging a
URL from a cross-origin iframe into the same tab.
- CVE-2023-23602: Fixed a mishandled security check, which caused
the Content Security Policy header to be ignored for WebSockets
in WebWorkers.
- CVE-2022-46877: Fixed a fullscreen notification bypass which
This update for MozillaFirefox fixes the following issues:
Firefox Extended Support Release 102.6.0 ESR (bsc#1206242):
- CVE-2022-46880: Use-after-free in WebGL
- CVE-2022-46872: Arbitrary file read from a compromised content process
- CVE-2022-46881: Memory corruption in WebGL
- CVE-2022-46874: Drag and Dropped Filenames could have been truncated to malicious extensions
- CVE-2022-46875: Download Protections were bypassed by .atloc and .ftploc files on Mac OS
- CVE-2022-46882: Use-after-free in WebGL
- CVE-2022-46878: Memory safety bugs fixed in Firefox 108 and Firefox ESR 102.6
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 102.5.0 ESR (MFSA 2022-48, bsc#1205270):
- CVE-2022-45403: Service Workers might have learned size of cross-origin media files
- CVE-2022-45404: Fullscreen notification bypass
- CVE-2022-45405: Use-after-free in InputStream implementation
- CVE-2022-45406: Use-after-free of a JavaScript Realm
- CVE-2022-45408: Fullscreen notification bypass via windowName
- CVE-2022-45409: Use-after-free in Garbage Collection
- CVE-2022-45410: ServiceWorker-intercepted requests bypassed SameSite cookie policy
- CVE-2022-45411: Cross-Site Tracing was possibl
This update for MozillaFirefox fixes the following issues:
- Updated to version 102.4.0 ESR (bsc#1204421)
- CVE-2022-42927: Fixed same-origin policy violation that could have leaked cross-origin URLs.
- CVE-2022-42928: Fixed memory Corruption in JS Engine.
- CVE-2022-42929: Fixed denial of Service via window.print.
- CVE-2022-42932: Fixed memory safety bugs.