1. Home
  2. Security Advisories
  3. AlmaLinux OS
  4. ALSA-2023:0808

[ALSA-2023:0808] firefox security update

Severity Important
Affected Packages 2
CVEs 12
Info Packages References Vulnerabilities

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

  • Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)
  • Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)
  • Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)
  • Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)
  • Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)
  • Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)
  • Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)
  • Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)
  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)
  • Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)
  • Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)
  • Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package Affected Version
pkg:rpm/almalinux/firefox?arch=x86_64&distro=almalinux-8.7 < 102.8.0-2.el8_7.alma
pkg:rpm/almalinux/firefox?arch=aarch64&distro=almalinux-8.7 < 102.8.0-2.el8_7.alma
ID
ALSA-2023:0808
Severity
important
URL
https://errata.almalinux.org/ALSA-2023:0808.html
Published
2023-02-20T00:00:00
(19 months ago)
Modified
2023-02-21T17:34:13
(19 months ago)
Rights
Copyright 2023 AlmaLinux OS
Other Advisories
Source # ID Name URL
RHSA RHSA-2023:0808 https://access.redhat.com/errata/RHSA-2023:0808
CVE CVE-2023-0767 https://access.redhat.com/security/cve/CVE-2023-0767
CVE CVE-2023-25728 https://access.redhat.com/security/cve/CVE-2023-25728
CVE CVE-2023-25729 https://access.redhat.com/security/cve/CVE-2023-25729
CVE CVE-2023-25730 https://access.redhat.com/security/cve/CVE-2023-25730
CVE CVE-2023-25732 https://access.redhat.com/security/cve/CVE-2023-25732
CVE CVE-2023-25735 https://access.redhat.com/security/cve/CVE-2023-25735
CVE CVE-2023-25737 https://access.redhat.com/security/cve/CVE-2023-25737
CVE CVE-2023-25739 https://access.redhat.com/security/cve/CVE-2023-25739
CVE CVE-2023-25742 https://access.redhat.com/security/cve/CVE-2023-25742
CVE CVE-2023-25743 https://access.redhat.com/security/cve/CVE-2023-25743
CVE CVE-2023-25744 https://access.redhat.com/security/cve/CVE-2023-25744
CVE CVE-2023-25746 https://access.redhat.com/security/cve/CVE-2023-25746
Bugzilla 2170374 https://bugzilla.redhat.com/2170374
Bugzilla 2170375 https://bugzilla.redhat.com/2170375
Bugzilla 2170376 https://bugzilla.redhat.com/2170376
Bugzilla 2170377 https://bugzilla.redhat.com/2170377
Bugzilla 2170378 https://bugzilla.redhat.com/2170378
Bugzilla 2170379 https://bugzilla.redhat.com/2170379
Bugzilla 2170381 https://bugzilla.redhat.com/2170381
Bugzilla 2170382 https://bugzilla.redhat.com/2170382
Bugzilla 2170383 https://bugzilla.redhat.com/2170383
Bugzilla 2170390 https://bugzilla.redhat.com/2170390
Bugzilla 2170391 https://bugzilla.redhat.com/2170391
Bugzilla 2170402 https://bugzilla.redhat.com/2170402
Self ALSA-2023:0808 https://errata.almalinux.org/8/ALSA-2023-0808.html
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/almalinux/firefox?arch=x86_64&distro=almalinux-8.7 almalinux firefox < 102.8.0-2.el8_7.alma almalinux-8.7 x86_64
Affected pkg:rpm/almalinux/firefox?arch=aarch64&distro=almalinux-8.7 almalinux firefox < 102.8.0-2.el8_7.alma almalinux-8.7 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date