Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

openSUSE: 2024:3898-1 important: MozillaFirefox XSS and DoS issues

opensuse
Calendar Grey November 4, 2024
Scroller Opensuse
Essential improvements for MozillaFirefox resolve several vulnerabilities; users are urged to apply updates immediately.
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 128.4.0 ESR (bsc#1231879):

Description

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 128.4.0 ESR (bsc#1231879):

* CVE-2024-10458: Permission leak via embed or object elements

* CVE-2024-10459: Use-after-free in layout with accessibility

* CVE-2024-10460: Confusing display of origin for external protocol handler

prompt

* CVE-2024-10461: XSS due to Content-Disposition being ignored in

multipart/x-mixed-replace response

* CVE-2024-10462: Origin of permission prompt could be spoofed by long URL

* CVE-2024-10463: Cross origin video frame leak

* CVE-2024-10464: History interface could have been used to cause a Denial of

Service condition in the browser

* CVE-2024-10465: Clipboard "paste" button persisted across tabs

* CVE-2024-10466: DOM push subscription message could hang Firefox

* CVE-2024-10467: Memory safety bugs fixed in Firefox 132, Thunderbird 132,

Firefox ESR 128.4, and Thunderbird 128.4

Topics%20covered

Topics Covered

security advisory XSS important Denial of Service SUSE MozillaFirefox permission leak

Patch

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2

zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-3898=1

* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3

zypper in -t patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-3898=1

* SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4

zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-3898=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP2

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-3898=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP3

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-3898=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP4

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-3898=1

* SUSE Enterprise Storage 7.1

zypper in -t patch SUSE-Storage-7.1-2024-3898=1

* openSUSE Leap 15.5

zyp...

Read the Full Advisory

Package List

* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x

x86_64)

* MozillaFirefox-debuginfo-128.4.0-150200.152.158.1

* MozillaFirefox-translations-other-128.4.0-150200.152.158.1

* MozillaFirefox-128.4.0-150200.152.158.1

* MozillaFirefox-debugsource-128.4.0-150200.152.158.1

* MozillaFirefox-translations-common-128.4.0-150200.152.158.1

* SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (noarch)

* MozillaFirefox-devel-128.4.0-150200.152.158.1

* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x

x86_64)

* MozillaFirefox-debuginfo-128.4.0-150200.152.158.1

* MozillaFirefox-translations-other-128.4.0-150200.152.158.1

* MozillaFirefox-128.4.0-150200.152.158.1

* MozillaFirefox-debugsource-128.4.0-150200.152.158.1

* MozillaFirefox-translations-common-128.4.0-150200.152.158.1

* SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (noarch)

* MozillaFirefox-devel-128.4.0-150200.152.158.1

* SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x

x86_64)

*...

Read the Full Advisory

References

* bsc#1231879

## References:

* https://www.suse.com/security/cve/CVE-2024-10458.html

* https://www.suse.com/security/cve/CVE-2024-10459.html

* https://www.suse.com/security/cve/CVE-2024-10460.html

* https://www.suse.com/security/cve/CVE-2024-10461.html

* https://www.suse.com/security/cve/CVE-2024-10462.html

* https://www.suse.com/security/cve/CVE-2024-10463.html

* https://www.suse.com/security/cve/CVE-2024-10464.html

* https://www.suse.com/security/cve/CVE-2024-10465.html

* https://www.suse.com/security/cve/CVE-2024-10466.html

* https://www.suse.com/security/cve/CVE-2024-10467.html

* https://bugzilla.suse.com/show_bug.cgi?id=1231879

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2024:3898-1
Release Date: 2024-11-04T11:15:08Z

Topics%20covered

Topics Covered

security advisory XSS important Denial of Service SUSE MozillaFirefox permission leak

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.