This update for MozillaFirefox fixes the following issues:
- Update to Firefox Extended Support Release 128.2.0 ESR (bsc#1229821)
- CVE-2024-8381: Type confusion when looking up a property name in a 'with' block
- CVE-2024-8382: Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran
- CVE-2024-8383: Firefox did not ask before openings news: links in an external application
- CVE-2024-8384: Garbage collection could mis-color cross-compartment objects in OOM conditions
- CVE-2024-8385: WASM type confusion involving ArrayTypes
- CVE-2024-8386: SelectElements could be shown over another site if pop
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 128.1.0 ESR (MFSA 2024-35, bsc#1228648)
- CVE-2024-7518: Fullscreen notification dialog can be obscured by document
- CVE-2024-7519: Out of bounds memory access in graphics shared memory handling
- CVE-2024-7520: Type confusion in WebAssembly
- CVE-2024-7521: Incomplete WebAssembly exception handing
- CVE-2024-7522: Out of bounds read in editor component
- CVE-2024-7524: CSP strict-dynamic bypass using web-compatibility shims
- CVE-2024-7525: Missing permission check when creating a StreamFilter
- CVE-2024-7526: Uninitial
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 115.13.0 ESR (MFSA 2024-30, bsc#1226316):
- CVE-2024-6600: Memory corruption in WebGL API
- CVE-2024-6601: Race condition in permission assignment
- CVE-2024-6602: Memory corruption in NSS
- CVE-2024-6603: Memory corruption in thread creation
- CVE-2024-6604: Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13
Other fixes:
- Fix GNOME search provider (bsc#1225278)
This update for MozillaFirefox fixes the following issues:
- Update to version 115.12.0 ESR (bsc#1226027)
- CVE-2024-5702: Use-after-free in networking
- CVE-2024-5688: Use-after-free in JavaScript object transplant
- CVE-2024-5690: External protocol handlers leaked by timing attack
- CVE-2024-5691: Sandboxed iframes were able to bypass sandbox restrictions to open a new window
- CVE-2024-5692: Bypass of file name restrictions during saving
- CVE-2024-5693: Cross-Origin Image leak via Offscreen Canvas
- CVE-2024-5696: Memory Corruption in Text Fragments
- CVE-2024-5700: Memory safety bugs fixed in Firefox 127, Firefox ESR 115.12, and Thunder
This update for MozillaFirefox fixes the following issues:
Update to version 115.11.0 ESR (bsc#1224056):
- CVE-2024-4367: Arbitrary JavaScript execution in PDF.js
- CVE-2024-4767: IndexedDB files retained in private browsing mode
- CVE-2024-4768: Potential permissions request bypass via clickjacking
- CVE-2024-4769: Cross-origin responses could be distinguished between script and non-script content-types
- CVE-2024-4770: Use-after-free could occur when printing to PDF
- CVE-2024-4777: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11