[ALSA-2024:1484] firefox security update

Severity Critical

Affected Packages 2

CVEs 10

firefox security update

Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.

This update upgrades Firefox to version 115.9.1 ESR.

Security Fix(es):

nss: timing attack against RSA decryption (CVE-2023-5388)
Mozilla: Crash in NSS TLS method (CVE-2024-0743)
Mozilla: JIT code failed to save return registers on Armv7-A (CVE-2024-2607)
Mozilla: Integer overflow could have led to out of bounds write (CVE-2024-2608)
Mozilla: Improve handling of out-of-memory conditions in ICU (CVE-2024-2616)
Mozilla: Improper handling of html and body tags enabled CSP nonce leakage (CVE-2024-2610)
Mozilla: Clickjacking vulnerability could have led to a user accidentally granting permissions (CVE-2024-2611)
Mozilla: Self referencing object could have potentially led to a use-after-free (CVE-2024-2612)
Mozilla: Memory safety bugs fixed in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9 (CVE-2024-2614)
Mozilla: Privileged JavaScript Execution via Event Handlers (CVE-2024-29944)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package	Affected Version
pkg:rpm/almalinux/firefox?arch=x86_64&distro=almalinux-8.9	< 115.9.1-1.el8_9.alma.1
pkg:rpm/almalinux/firefox?arch=aarch64&distro=almalinux-8.9	< 115.9.1-1.el8_9.alma.1

ID

ALSA-2024:1484

Severity

critical

URL

https://errata.almalinux.org/ALSA-2024:1484.html

Published

2024-03-25T00:00:00
(5 months ago)

Modified

2024-04-03T14:52:34
(5 months ago)

Rights

Other Advisories

Source	# ID	URL
RHSA	RHSA-2024:1484	https://access.redhat.com/errata/RHSA-2024:1484
CVE	CVE-2023-5388	https://access.redhat.com/security/cve/CVE-2023-5388
CVE	CVE-2024-0743	https://access.redhat.com/security/cve/CVE-2024-0743
CVE	CVE-2024-2607	https://access.redhat.com/security/cve/CVE-2024-2607
CVE	CVE-2024-2608	https://access.redhat.com/security/cve/CVE-2024-2608
CVE	CVE-2024-2610	https://access.redhat.com/security/cve/CVE-2024-2610
CVE	CVE-2024-2611	https://access.redhat.com/security/cve/CVE-2024-2611
CVE	CVE-2024-2612	https://access.redhat.com/security/cve/CVE-2024-2612
CVE	CVE-2024-2614	https://access.redhat.com/security/cve/CVE-2024-2614
CVE	CVE-2024-2616	https://access.redhat.com/security/cve/CVE-2024-2616
CVE	CVE-2024-29944	https://access.redhat.com/security/cve/CVE-2024-29944
Bugzilla	2243644	https://bugzilla.redhat.com/2243644
Bugzilla	2260012	https://bugzilla.redhat.com/2260012
Bugzilla	2270660	https://bugzilla.redhat.com/2270660
Bugzilla	2270661	https://bugzilla.redhat.com/2270661
Bugzilla	2270662	https://bugzilla.redhat.com/2270662
Bugzilla	2270663	https://bugzilla.redhat.com/2270663
Bugzilla	2270664	https://bugzilla.redhat.com/2270664
Bugzilla	2270665	https://bugzilla.redhat.com/2270665
Bugzilla	2270666	https://bugzilla.redhat.com/2270666
Bugzilla	2271064	https://bugzilla.redhat.com/2271064
Self	ALSA-2024:1484	https://errata.almalinux.org/8/ALSA-2024-1484.html

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:rpm/almalinux/firefox?arch=x86_64&distro=almalinux-8.9	almalinux	firefox	< 115.9.1-1.el8_9.alma.1	almalinux-8.9	x86_64
Affected	pkg:rpm/almalinux/firefox?arch=aarch64&distro=almalinux-8.9	almalinux	firefox	< 115.9.1-1.el8_9.alma.1	almalinux-8.9	aarch64

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date