Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 511
Alerts This Week
Warning Icon 1 511

SUSE: SUSE-SU-2022:14906-1 Important: MozillaFirefox Security Update

suse
Calendar Grey March 11, 2022
Scroller Suse
New patch issued for Mozilla Firefox addressing major vulnerabilities and improving protection for SUSE platforms. Prompt implementation recommended.
An update that fixes 7 vulnerabilities is now available

Summary

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.7.0 ESR (bsc#1196900): - CVE-2022-26383: Browser window spoof using fullscreen mode - CVE-2022-26384: iframe allow-scripts sandbox bypass - CVE-2022-26387: Time-of-check time-of-use bug when verifying add-on signatures - CVE-2022-26381: Use-after-free in text reflows - CVE-2022-26386: Temporary files downloaded to /tmp and accessible by other local users Firefox Extended Support Release 91.6.1 ESR (bsc#1196809): - CVE-2022-26485: Use-after-free in XSLT parameter processing - CVE-2022-26486: Use-after-free in WebGPU IPC Framework Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

Topics%20covered

Topics Covered

security advisory security update bug fix important SUSE MozillaFirefox

References

#1196809 #1196900

Cross- CVE-2022-26381 CVE-2022-26383 CVE-2022-26384

CVE-2022-26386 CVE-2022-26387 CVE-2022-26485

CVE-2022-26486

CVSS scores:

CVE-2022-26485 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2022-26486 (SUSE): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products:

SUSE Linux Enterprise Debuginfo 11-SP4

SUSE Linux Enterprise Server 11-SP4-LTSS

https://www.suse.com/security/cve/CVE-2022-26381.html

https://www.suse.com/security/cve/CVE-2022-26383.html

https://www.suse.com/security/cve/CVE-2022-26384.html

https://www.suse.com/security/cve/CVE-2022-26386.html

https://www.suse.com/security/cve/CVE-2022-26387.html

https://www.suse.com/security/cve/CVE-2022-26485.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:14906-1
Rating: important

Topics%20covered

Topics Covered

security advisory security update bug fix important SUSE MozillaFirefox

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.