[RHSA-2022:0824] firefox security and bug fix update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
This update upgrades Firefox to version 91.7.0 ESR.
Security Fix(es):
Mozilla: Use-after-free in XSLT parameter processing (CVE-2022-26485)
Mozilla: Use-after-free in WebGPU IPC Framework (CVE-2022-26486)
expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution (CVE-2022-25235)
expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution (CVE-2022-25236)
expat: Integer overflow in storeRawNames() (CVE-2022-25315)
Mozilla: Use-after-free in text reflows (CVE-2022-26381)
Mozilla: Browser window spoof using fullscreen mode (CVE-2022-26383)
Mozilla: iframe allow-scripts sandbox bypass (CVE-2022-26384)
Mozilla: Time-of-check time-of-use bug when verifying add-on signatures (CVE-2022-26387)
Mozilla: Temporary files downloaded to /tmp and accessible by other local users (CVE-2022-26386)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- Firefox 91.3.0-1 Language packs installed at /usr/lib64/firefox/langpacks cannot be used any more (BZ#2030190)
Package | Affected Version |
---|---|
pkg:rpm/redhat/firefox?arch=x86_64&distro=redhat-7.9 | < 91.7.0-3.el7_9 |
pkg:rpm/redhat/firefox?arch=s390x&distro=redhat-7.9 | < 91.7.0-3.el7_9 |
pkg:rpm/redhat/firefox?arch=ppc64le&distro=redhat-7.9 | < 91.7.0-3.el7_9 |
pkg:rpm/redhat/firefox?arch=ppc64&distro=redhat-7.9 | < 91.7.0-3.el7_9 |
pkg:rpm/redhat/firefox?arch=i686&distro=redhat-7.9 | < 91.7.0-3.el7_9 |
- ID
- RHSA-2022:0824
- Severity
- critical
- URL
- https://access.redhat.com/errata/RHSA-2022:0824
- Published
-
2022-03-10T00:00:00
(2 years ago) - Modified
-
2022-03-10T00:00:00
(2 years ago) - Rights
- Copyright 2022 Red Hat, Inc.
- Other Advisories
-
- ALAS-2022-1570
- ALAS-2022-1573
- ALAS-2022-1585
- ALAS2-2022-1759
- ALAS2-2022-1764
- ALAS2-2022-1779
- ALAS2-2022-1795
- ALPINE:CVE-2022-25235
- ALPINE:CVE-2022-25236
- ALPINE:CVE-2022-25315
- ALPINE:CVE-2022-26381
- ALPINE:CVE-2022-26383
- ALPINE:CVE-2022-26384
- ALPINE:CVE-2022-26386
- ALPINE:CVE-2022-26387
- ALPINE:CVE-2022-26485
- ALPINE:CVE-2022-26486
- ALSA-2022:0818
- ALSA-2022:0845
- ALSA-2022:0951
- ALSA-2022:1643
- ALSA-2022:7811
- CISA-2022:0307
- DSA-5085-1
- DSA-5090-1
- DSA-5094-1
- DSA-5097-1
- DSA-5106-1
- ELSA-2022-0818
- ELSA-2022-0824
- ELSA-2022-0845
- ELSA-2022-0850
- ELSA-2022-0951
- ELSA-2022-1069
- ELSA-2022-1643
- ELSA-2022-9359
- FEDORA-2022-01f0553b59
- FEDORA-2022-04f206996b
- FEDORA-2022-3d9d67f558
- FEDORA-2022-4f28c7541d
- FEDORA-2022-f202d1a045
- FEDORA-2023-97a977a96a
- FEDORA-2023-99ba1917da
- GLSA-202208-08
- GLSA-202208-14
- GLSA-202209-24
- MFSA-2022-09
- MFSA-2022-10
- MFSA-2022-11
- MFSA-2022-12
- MS:CVE-2022-25235
- MS:CVE-2022-25236
- MS:CVE-2022-25315
- openSUSE-SU-2022:0713-1
- openSUSE-SU-2022:0783-1
- openSUSE-SU-2022:0804-1
- openSUSE-SU-2022:0821-1
- openSUSE-SU-2022:0844-1
- openSUSE-SU-2022:0906-1
- RHSA-2022:0818
- RHSA-2022:0845
- RHSA-2022:0850
- RHSA-2022:0951
- RHSA-2022:1069
- RHSA-2022:1643
- RHSA-2022:7811
- SSA:2022-050-01
- SSA:2022-064-01
- SSA:2022-068-01
- SUSE-SU-2022:0698-1
- SUSE-SU-2022:0713-1
- SUSE-SU-2022:0777-1
- SUSE-SU-2022:0778-1
- SUSE-SU-2022:0783-1
- SUSE-SU-2022:0804-1
- SUSE-SU-2022:0819-1
- SUSE-SU-2022:0821-1
- SUSE-SU-2022:0822-1
- SUSE-SU-2022:0842-1
- SUSE-SU-2022:0844-1
- SUSE-SU-2022:0844-2
- SUSE-SU-2022:0906-1
- SUSE-SU-2022:2294-1
- SUSE-SU-2024:0782-1
- SUSE-SU-2024:0782-2
- SUSE-SU-2024:0784-1
- USN-5288-1
- USN-5314-1
- USN-5320-1
- USN-5321-1
- USN-5321-2
- USN-5345-1
- USN-5455-1
Type | Package URL | Namespace | Name / Product | Version | Distribution / Platform | Arch | Patch / Fix |
---|---|---|---|---|---|---|---|
Affected | pkg:rpm/redhat/firefox?arch=x86_64&distro=redhat-7.9 | redhat | firefox | < 91.7.0-3.el7_9 | redhat-7.9 | x86_64 | |
Affected | pkg:rpm/redhat/firefox?arch=s390x&distro=redhat-7.9 | redhat | firefox | < 91.7.0-3.el7_9 | redhat-7.9 | s390x | |
Affected | pkg:rpm/redhat/firefox?arch=ppc64le&distro=redhat-7.9 | redhat | firefox | < 91.7.0-3.el7_9 | redhat-7.9 | ppc64le | |
Affected | pkg:rpm/redhat/firefox?arch=ppc64&distro=redhat-7.9 | redhat | firefox | < 91.7.0-3.el7_9 | redhat-7.9 | ppc64 | |
Affected | pkg:rpm/redhat/firefox?arch=i686&distro=redhat-7.9 | redhat | firefox | < 91.7.0-3.el7_9 | redhat-7.9 | i686 |
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | Exploits | PoC | Pubblication Date | Modification Date |
---|---|---|---|---|---|---|---|---|---|---|---|
# CVE | Description | CVSS | EPSS | EPSS Trend (30 days) | Affected Products | Weaknesses | Security Advisories | PoC | Pubblication Date | Modification Date |