1. Home
  2. Security Advisories
  3. Rocky Linux
  4. RLSA-2023:0808

[RLSA-2023:0808] firefox security update

Severity Important
Affected Packages 2
CVEs 12
Info Packages References Vulnerabilities

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 102.8.0 ESR.

Security Fix(es):

  • Mozilla: Arbitrary memory write via PKCS 12 in NSS (CVE-2023-0767)

  • Mozilla: Content security policy leak in violation reports using iframes (CVE-2023-25728)

  • Mozilla: Screen hijack via browser fullscreen mode (CVE-2023-25730)

  • Mozilla: Potential use-after-free from compartment mismatch in SpiderMonkey (CVE-2023-25735)

  • Mozilla: Invalid downcast in SVGUtils::SetupStrokeGeometry (CVE-2023-25737)

  • Mozilla: Use-after-free in mozilla::dom::ScriptLoadContext::~ScriptLoadContext (CVE-2023-25739)

  • Mozilla: Fullscreen notification not shown in Firefox Focus (CVE-2023-25743)

  • Mozilla: Memory safety bugs fixed in Firefox 110 and Firefox ESR 102.8 (CVE-2023-25744)

  • Mozilla: Memory safety bugs fixed in Firefox ESR 102.8 (CVE-2023-25746)

  • Mozilla: Extensions could have opened external schemes without user knowledge (CVE-2023-25729)

  • Mozilla: Out of bounds memory write from EncodeInputStream (CVE-2023-25732)

  • Mozilla: Web Crypto ImportKey crashes tab (CVE-2023-25742)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package Affected Version
pkg:rpm/rockylinux/firefox?arch=x86_64&distro=rockylinux-8.7 < 102.8.0-2.el8_7
pkg:rpm/rockylinux/firefox?arch=aarch64&distro=rockylinux-8.7 < 102.8.0-2.el8_7
ID
RLSA-2023:0808
Severity
important
URL
https://errata.rockylinux.org/RLSA-2023:0808
Published
2023-02-22T01:08:53
(19 months ago)
Modified
2023-02-22T01:10:35
(19 months ago)
Rights
Copyright 2024 Rocky Enterprise Software Foundation
Other Advisories
Source # ID Name URL
CVE CVE-2023-0767 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0767
CVE CVE-2023-25728 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25728
CVE CVE-2023-25729 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25729
CVE CVE-2023-25730 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25730
CVE CVE-2023-25732 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25732
CVE CVE-2023-25735 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25735
CVE CVE-2023-25737 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25737
CVE CVE-2023-25739 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25739
CVE CVE-2023-25742 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25742
CVE CVE-2023-25743 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25743
CVE CVE-2023-25744 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25744
CVE CVE-2023-25746 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25746
Bugzilla 2170374 https://bugzilla.redhat.com/show_bug.cgi?id=2170374
Bugzilla 2170375 https://bugzilla.redhat.com/show_bug.cgi?id=2170375
Bugzilla 2170376 https://bugzilla.redhat.com/show_bug.cgi?id=2170376
Bugzilla 2170377 https://bugzilla.redhat.com/show_bug.cgi?id=2170377
Bugzilla 2170378 https://bugzilla.redhat.com/show_bug.cgi?id=2170378
Bugzilla 2170379 https://bugzilla.redhat.com/show_bug.cgi?id=2170379
Bugzilla 2170381 https://bugzilla.redhat.com/show_bug.cgi?id=2170381
Bugzilla 2170382 https://bugzilla.redhat.com/show_bug.cgi?id=2170382
Bugzilla 2170383 https://bugzilla.redhat.com/show_bug.cgi?id=2170383
Bugzilla 2170390 https://bugzilla.redhat.com/show_bug.cgi?id=2170390
Bugzilla 2170391 https://bugzilla.redhat.com/show_bug.cgi?id=2170391
Bugzilla 2170402 https://bugzilla.redhat.com/show_bug.cgi?id=2170402
Self RLSA-2023:0808 https://errata.rockylinux.org/RLSA-2023:0808
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/rockylinux/firefox?arch=x86_64&distro=rockylinux-8.7 rockylinux firefox < 102.8.0-2.el8_7 rockylinux-8.7 x86_64
Affected pkg:rpm/rockylinux/firefox?arch=aarch64&distro=rockylinux-8.7 rockylinux firefox < 102.8.0-2.el8_7 rockylinux-8.7 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date