SUSE: 2022:14906-1 important: MozillaFirefox
Summary
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.7.0 ESR (bsc#1196900): - CVE-2022-26383: Browser window spoof using fullscreen mode - CVE-2022-26384: iframe allow-scripts sandbox bypass - CVE-2022-26387: Time-of-check time-of-use bug when verifying add-on signatures - CVE-2022-26381: Use-after-free in text reflows - CVE-2022-26386: Temporary files downloaded to /tmp and accessible by other local users Firefox Extended Support Release 91.6.1 ESR (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SP4-LTSS: zypper in -t patch slessp4-MozillaFirefox-14906=1 - SUSE Linux Enterprise Debuginfo 11-SP4: zypper in -t patch dbgsp4-MozillaFirefox-14906=1 Package List: - SUSE Linux Enterprise Server 11-SP4-LTSS (x86_64): MozillaFirefox-91.7.0-78.167.1 MozillaFirefox-translations-common-91.7.0-78.167.1 MozillaFirefox-translations-other-91.7.0-78.167.1 - SUSE Linux Enterprise Debuginfo 11-SP4 (x86_64): MozillaFirefox-debuginfo-91.7.0-78.167.1
References
#1196809 #1196900
Cross- CVE-2022-26381 CVE-2022-26383 CVE-2022-26384
CVE-2022-26386 CVE-2022-26387 CVE-2022-26485
CVE-2022-26486
CVSS scores:
CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products:
SUSE Linux Enterprise Debuginfo 11-SP4
SUSE Linux Enterprise Server 11-SP4-LTSS
https://www.suse.com/security/cve/CVE-2022-26381.html
https://www.suse.com/security/cve/CVE-2022-26383.html
https://www.suse.com/security/cve/CVE-2022-26384.html
https://www.suse.com/security/cve/CVE-2022-26386.html
https://www.suse.com/security/cve/CVE-2022-26387.html
https://www.suse.com/security/cve/CVE-2022-26485.html
https://www.suse.com/security/cve/CVE-2022-26486.html
https://bugzilla.suse.com/1196809
https://bugzilla.suse.com/1196900