This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.7.0 ESR (MFSA 2021-04, bsc#1181414)
* CVE-2021-23953: Fixed a Cross-origin information leakage via redirected PDF requests
* CVE-2021-23954: Fixed a type confusion when using logical assignment operators in JavaScript switch statements
* CVE-2020-26976: Fixed an issue where HTTPS pages could have been intercepted by a registered service worker when they should not have been
* CVE-2021-23960: Fixed a use-after-poison for incorrectly redeclared JavaScript variables during GC
* CVE-2021-23964: Fixed Memory safety bugs
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.6.1 ESR
* Fixed: Critical security issue MFSA 2021-01 (bsc#1180623)
* CVE-2020-16044
Use-after-free write when handling a malicious COOKIE-ECHO SCTP chunk
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.6.0 ESR
* Fixed: Various stability, functionality, and security fixes
MFSA 2020-55 (bsc#1180039)
* CVE-2020-16042 (bmo#1679003)
Operations on a BigInt could have caused uninitialized memory
to be exposed
* CVE-2020-26971 (bmo#1663466)
Heap buffer overflow in WebGL
* CVE-2020-26973 (bmo#1680084)
CSS Sanitizer performed incorrect sanitization
* CVE-2020-26974 (bmo#1681022)
Incorrect cast of StyleGenericFlexBasis resulted in a heap
use-after-free
* CVE-2020-26978 (bmo#1677047)
Internal network hosts could ha
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.5.0 ESR (bsc#1178824)
* CVE-2020-26951: Parsing mismatches could confuse and bypass security sanitizer for chrome privileged code
* CVE-2020-16012: Variable time processing of cross-origin images during drawImage calls
* CVE-2020-26953: Fullscreen could be enabled without displaying the security UI
* CVE-2020-26956: XSS through paste (manual and clipboard API)
* CVE-2020-26958: Requests intercepted through ServiceWorkers lacked MIME type restrictions
* CVE-2020-26959: Use-after-free in WebRequestService
* CVE-2020-26960: Potential u
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.4.1 ESR
* Fixed: Security fix
MFSA 2020-49 (bsc#1178588)
* CVE-2020-26950 (bmo#1675905)
Write side effects in MCallGetProperty opcode not accounted
for
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.4.0 ESR
* Fixed: Various stability, functionality, and security fixes MFSA 2020-46 (bsc#1177872, bsc#1176756)
* CVE-2020-15969 Use-after-free in usersctp
* CVE-2020-15683 Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4
* Fixed: Fixed legacy preferences not being properly applied when set via GPO
This update for MozillaFirefox fixes the following issues:
-Firefox was updated to 78.3.0 ESR (bsc#1176756, MFSA 2020-43)
- CVE-2020-15677: Download origin spoofing via redirect
- CVE-2020-15676: Fixed an XSS when pasting attacker-controlled data into a
contenteditable element
- CVE-2020-15678: When recursing through layers while scrolling, an iterator
may have become invalid, resulting in a potential use-after-free scenario
- CVE-2020-15673: Fixed memory safety bugs
- Enhance fix for wayland-detection (bsc#1174420)
- Attempt to fix langpack-parallelization by introducing separate
obj-dirs for each lang (bsc#1173986
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.2.0 ESR
* Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
MFSA 2020-38 (bsc#1175686)
* CVE-2020-15663 (bmo#1643199)
Downgrade attack on the Mozilla Maintenance Service could
have resulted in escalation of privilege
* CVE-2020-15664 (bmo#1658214)
Attacker-induced prompt for extension installation
* CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
bmo#1656957)
Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2
- Fixed Firefox tab crash in FIPS mode (bsc#1174284).
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 78.1.0 ESR
* Fixed: Various stability, functionality, and security fixes (bsc#1174538)
* CVE-2020-15652: Potential leak of redirect targets when loading scripts in a worker
* CVE-2020-6514: WebRTC data channel leaks internal address to peer
* CVE-2020-15655: Extension APIs could be used to bypass Same-Origin Policy
* CVE-2020-15653: Bypassing iframe sandbox when allowing popups
* CVE-2020-6463: Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
* CVE-2020-15656: Type confusion for special arguments in IonMonkey
* CVE-2020-
This update for MozillaFirefox fixes the following issues:
- Mozilla Firefox 78.0.2
MFSA 2020-28 (bsc#1173948)
* MFSA-2020-0003 (bmo#1644076)
X-Frame-Options bypass using object or embed tags
- Firefox Extended Support Release 78.0.2esr ESR
* Fixed: Security fix
* Fixed: Fixed an accessibility regression in reader mode
(bmo#1650922)
* Fixed: Made the address bar more resilient to data corruption
in the user profile (bmo#1649981)
* Fixed: Fixed a regression opening certain external
applications (bmo#1650162)
This update for MozillaFirefox to version 78.0.1 ESR fixes the following issues:
Security issues fixed:
- CVE-2020-12415: AppCache manifest poisoning due to url encoded character processing (bsc#1173576).
- CVE-2020-12416: Use-after-free in WebRTC VideoBroadcaster (bsc#1173576).
- CVE-2020-12417: Memory corruption due to missing sign-extension for ValueTags on ARM64 (bsc#1173576).
- CVE-2020-12418: Information disclosure due to manipulated URL object (bsc#1173576).
- CVE-2020-12419: Use-after-free in nsGlobalWindowInner (bsc#1173576).
- CVE-2020-12420: Use-After-Free when trying to connect to a STUN server (bsc#1173576).
- CVE-2020-12402: R
This update for MozillaFirefox fixes the following issues:
- MozillaFirefox was updated to version 68.9.0 Extended Support Release (bsc#1172402).
- CVE-2020-12405: Fixed a use-after-free in SharedWorkerService.
- CVE-2020-12406: Fixed a JavaScript Type confusion with NativeTypes.
- CVE-2020-12410: Fixed multiple memory safety bugs.
This update for MozillaFirefox fixes the following issues:
Update to version 68.8.0 ESR (bsc#1171186):
- CVE-2020-12387: Use-after-free during worker shutdown
- CVE-2020-12388: Sandbox escape with improperly guarded Access Tokens
- CVE-2020-12389: Sandbox escape with improperly separated process types
- CVE-2020-6831: Buffer overflow in SCTP chunk input validation
- CVE-2020-12392: Arbitrary local file access with 'Copy as cURL'
- CVE-2020-12393: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection
- CVE-2020-12395: Memory safety bugs fixed in Firefox 76 and Firefox ESR 68.8
This update for MozillaFirefox to version 68.7.0 ESR fixes the following issues:
- CVE-2020-6821: Uninitialized memory could be read when using the WebGL copyTexSubImage method (bsc#1168874).
- CVE-2020-6822: Fixed out of bounds write in GMPDecodeData when processing large images (bsc#1168874).
- CVE-2020-6825: Fixed Memory safety bugs (bsc#1168874).
- CVE-2020-6827: Custom Tabs could have the URI spoofed (bsc#1168874).
- CVE-2020-6828: Preference overwrite via crafted Intent (bsc#1168874).
This update for MozillaFirefox fixes the following issues:
- Mozilla Firefox 68.6.1esr
MFSA 2020-11 (bsc#1168630)
* CVE-2020-6819 (bmo#1620818)
Use-after-free while running the nsDocShell destructor
* CVE-2020-6820 (bmo#1626728)
Use-after-free when handling a ReadableStream
This update for MozillaFirefox fixes the following issues:
MozillaFirefox was updated to 68.6.0 ESR (MFSA 2020-09 bsc#1132665 bsc#1166238)
- CVE-2020-6805: Fixed a use-after-free when removing data about origins
- CVE-2020-6806: Fixed improper protections against state confusion
- CVE-2020-6807: Fixed a use-after-free in cubeb during stream destruction
- CVE-2020-6811: Fixed an issue where copy as cURL' feature did not fully
escape website-controlled data potentially leading to command injection
- CVE-2019-20503: Fixed out of bounds reads in sctp_load_addresses_from_init
- CVE-2020-6812: Fixed an issue where the names of AirPods with p
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 68.5.0 ESR
* Fixed: Various stability and security fixes
- Mozilla Firefox ESR68.5
MFSA 2020-06 (bsc#1163368)
* CVE-2020-6796 (bmo#1610426)
Missing bounds check on shared memory read in the parent
process
* CVE-2020-6797 (bmo#1596668)
Extensions granted downloads.open permission could open
arbitrary applications on Mac OSX
* CVE-2020-6798 (bmo#1602944)
Incorrect parsing of template tag could result in JavaScript
injection
* CVE-2020-6799 (bmo#1606596)
Arbitrary code execution when opening pdf links from other
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 68.4.1 ESR
* Fixed: Security fix
MFSA 2020-03 (bsc#1160498)
* CVE-2019-17026 (bmo#1607443)
IonMonkey type confusion with StoreElementHole and
FallibleStoreElement
- Firefox Extended Support Release 68.4.0 ESR
* Fixed: Various security fixes
MFSA 2020-02 (bsc#1160305)
* CVE-2019-17015 (bmo#1599005)
Memory corruption in parent process during new content
process initialization on Windows
* CVE-2019-17016 (bmo#1599181)
Bypass of @namespace CSS sanitization during pasting
* CVE-2019-17017 (bmo#1603055)
Type Confus
This update for MozillaFirefox fixes the following issues:
Mozilla Firefox was updated to 68.3esr (MFSA 2019-37 bsc#1158328)
Security issues fixed:
- CVE-2019-17008: Fixed a use-after-free in worker destruction (bmo#1546331)
- CVE-2019-13722: Fixed a stack corruption due to incorrect number of arguments
in WebRTC code (bmo#1580156)
- CVE-2019-11745: Fixed an out of bounds write in NSS when encrypting with a
block cipher (bmo#1586176)
- CVE-2019-17009: Fixed an issue where updater temporary files accessible to
unprivileged processes (bmo#1510494)
- CVE-2019-17010: Fixed a use-after-free when performing device orientation
Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues:
Changes in MozillaFirefox:
Security issues fixed:
- CVE-2019-15903: Fixed a heap overflow in the expat library (bsc#1149429).
- CVE-2019-11757: Fixed a use-after-free when creating index updates in IndexedDB (bsc#1154738).
- CVE-2019-11758: Fixed a potentially exploitable crash due to 360 Total Security (bsc#1154738).
- CVE-2019-11759: Fixed a stack buffer overflow in HKDF output (bsc#1154738).
- CVE-2019-11760: Fixed a stack buffer overflow in WebRTC networking (bsc#1154738).
- CVE-2019-11761: Fixed an unintended access to a privileged JSONView o