Most recent entries from all

ALSA-2023:0285 — Important: firefox security update

Affected: AlmaLinux:9: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.7.0 ESR.

Security Fix(es):

* Mozilla: libusrsctp library out of date (CVE-2022-46871) * Mozilla: Arbitrary file read from GTK drag and drop on Linux (CVE-2023-23598) * Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7 (CVE-2023-23605) * Mozilla: Malicious command could be hidden in devtools output (CVE-2023-23599) * Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation (CVE-2023-23601) * Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers (CVE-2023-23602) * Mozilla: Fullscreen notification bypass (CVE-2022-46877) * Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive (CVE-2023-23603)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2023-00384

certfr-2022-avi-1095 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2022-avi-1095

EUVD-2026-229678

fkie_cve-2022-46877

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.

GHSA-qhr9-wjgv-2r72

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.

gsd-2022-46877

openSUSE-SU-2024:12577-1 — MozillaFirefox-108.0.1-1.1 on GA media

MozillaFirefox-108.0.1-1.1 on GA media

RHSA-2023:0286 — Red Hat Security Advisory: firefox security update

Mozilla: libusrsctp library out of date Mozilla: Fullscreen notification bypass Mozilla: Arbitrary file read from GTK drag and drop on Linux Mozilla: Malicious command could be hidden in devtools output Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

SUSE-SU-2023:0111-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2022-46877

Affected: Ubuntu:18.04:LTS: firefox, Ubuntu:18.04:LTS: thunderbird, Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: firefox, Ubuntu:20.04:LTS: thunderbird, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91 and 1 more

By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.

WID-SEC-W-2022-2319 — Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, den Benutzer zu täuschen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen und nicht näher beschriebene Auswirkungen zu erzielen.