1. Home
  2. Security Advisories
  3. Rocky Linux
  4. RLSA-2024:0012

[RLSA-2024:0012] firefox security update

Severity Important
Affected Packages 1
CVEs 11
Info Packages References Vulnerabilities

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.6.0 ESR.

Security Fix(es):

  • Mozilla: Heap-buffer-overflow affecting WebGL <code>DrawElementsInstanced</code> method with Mesa VM driver (CVE-2023-6856)

  • Mozilla: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6 (CVE-2023-6864)

  • Mozilla: Potential exposure of uninitialized data in <code>EncryptingOutputStream</code> (CVE-2023-6865)

  • Mozilla: Symlinks may resolve to smaller than expected buffers (CVE-2023-6857)

  • Mozilla: Heap buffer overflow in <code>nsTextFragment</code> (CVE-2023-6858)

  • Mozilla: Use-after-free in PR_GetIdentitiesLayer (CVE-2023-6859)

  • Mozilla: Potential sandbox escape due to <code>VideoBridge</code> lack of texture validation (CVE-2023-6860)

  • Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode (CVE-2023-6861)

  • Mozilla: Use-after-free in <code>nsDNSService</code> (CVE-2023-6862)

  • Mozilla: Clickjacking permission prompts using the popup transition (CVE-2023-6867)

  • Mozilla: Undefined behavior in <code>ShutdownObserver()</code> (CVE-2023-6863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package Affected Version
pkg:rpm/rockylinux/firefox?arch=aarch64&distro=rockylinux-8.9 < 115.6.0-1.el8_9
ID
RLSA-2024:0012
Severity
important
URL
https://errata.rockylinux.org/RLSA-2024:0012
Published
2024-01-09T04:07:41
(8 months ago)
Modified
2024-01-09T04:09:09
(8 months ago)
Rights
Copyright 2024 Rocky Enterprise Software Foundation
Other Advisories
Source # ID Name URL
CVE CVE-2023-6856 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6856
CVE CVE-2023-6857 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6857
CVE CVE-2023-6858 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6858
CVE CVE-2023-6859 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6859
CVE CVE-2023-6860 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6860
CVE CVE-2023-6861 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6861
CVE CVE-2023-6862 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6862
CVE CVE-2023-6863 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6863
CVE CVE-2023-6864 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6864
CVE CVE-2023-6865 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6865
CVE CVE-2023-6867 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6867
Bugzilla 2255360 https://bugzilla.redhat.com/show_bug.cgi?id=2255360
Bugzilla 2255361 https://bugzilla.redhat.com/show_bug.cgi?id=2255361
Bugzilla 2255362 https://bugzilla.redhat.com/show_bug.cgi?id=2255362
Bugzilla 2255363 https://bugzilla.redhat.com/show_bug.cgi?id=2255363
Bugzilla 2255364 https://bugzilla.redhat.com/show_bug.cgi?id=2255364
Bugzilla 2255365 https://bugzilla.redhat.com/show_bug.cgi?id=2255365
Bugzilla 2255366 https://bugzilla.redhat.com/show_bug.cgi?id=2255366
Bugzilla 2255367 https://bugzilla.redhat.com/show_bug.cgi?id=2255367
Bugzilla 2255368 https://bugzilla.redhat.com/show_bug.cgi?id=2255368
Bugzilla 2255369 https://bugzilla.redhat.com/show_bug.cgi?id=2255369
Bugzilla 2255370 https://bugzilla.redhat.com/show_bug.cgi?id=2255370
Self RLSA-2024:0012 https://errata.rockylinux.org/RLSA-2024:0012
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/rockylinux/firefox?arch=aarch64&distro=rockylinux-8.9 rockylinux firefox < 115.6.0-1.el8_9 rockylinux-8.9 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date