MozillaFirefox-95.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:11669 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z MozillaFirefox-95.0-1.1 on GA media These are all security issues fixed in the MozillaFirefox-95.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-11669 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:11669 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-43536/ SUSE CVE CVE-2021-43536 page https://www.suse.com/security/cve/CVE-2021-43537/ SUSE CVE CVE-2021-43537 page https://www.suse.com/security/cve/CVE-2021-43538/ SUSE CVE CVE-2021-43538 page https://www.suse.com/security/cve/CVE-2021-43539/ SUSE CVE CVE-2021-43539 page https://www.suse.com/security/cve/CVE-2021-43540/ SUSE CVE CVE-2021-43540 page https://www.suse.com/security/cve/CVE-2021-43541/ SUSE CVE CVE-2021-43541 page https://www.suse.com/security/cve/CVE-2021-43542/ SUSE CVE CVE-2021-43542 page https://www.suse.com/security/cve/CVE-2021-43543/ SUSE CVE CVE-2021-43543 page https://www.suse.com/security/cve/CVE-2021-43544/ SUSE CVE CVE-2021-43544 page https://www.suse.com/security/cve/CVE-2021-43545/ SUSE CVE CVE-2021-43545 page https://www.suse.com/security/cve/CVE-2021-43546/ SUSE CVE CVE-2021-43546 page openSUSE Tumbleweed MozillaFirefox-95.0-1.1 MozillaFirefox-branding-upstream-95.0-1.1 MozillaFirefox-devel-95.0-1.1 MozillaFirefox-translations-common-95.0-1.1 MozillaFirefox-translations-other-95.0-1.1 MozillaFirefox-95.0-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-branding-upstream-95.0-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-devel-95.0-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-translations-common-95.0-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-translations-other-95.0-1.1 as a component of openSUSE Tumbleweed Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43536 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43536.html CVE-2021-43536 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43537 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43537.html CVE-2021-43537 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43538 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43538.html CVE-2021-43538 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Failure to correctly record the location of live pointers across wasm instance calls resulted in a GC occurring within the call not tracing those live pointers. This could have led to a use-after-free causing a potentially exploitable crash. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43539 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43539.html CVE-2021-43539 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 WebExtensions with the correct permissions were able to create and install ServiceWorkers for third-party websites that would not have been uninstalled with the extension. This vulnerability affects Firefox < 95. CVE-2021-43540 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43540.html CVE-2021-43540 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 When invoking protocol handlers for external protocols, a supplied parameter URL containing spaces was not properly escaped. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43541 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43541.html CVE-2021-43541 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Using XMLHttpRequest, an attacker could have identified installed applications by probing error messages for loading external protocols. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43542 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43542.html CVE-2021-43542 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Documents loaded with the CSP sandbox directive could have escaped the sandbox's script restriction by embedding additional content. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43543 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43543.html CVE-2021-43543 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 When receiving a URL through a SEND intent, Firefox would have searched for the text, but subsequent usages of the address bar might have caused the URL to load unintentionally, which could lead to XSS and spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95. CVE-2021-43544 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43544.html CVE-2021-43544 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 Using the Location API in a loop could have caused severe application hangs and crashes. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43545 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43545.html CVE-2021-43545 https://bugzilla.suse.com/1193485 SUSE Bug 1193485 It was possible to recreate previous cursor spoofing attacks against users with a zoomed native cursor. This vulnerability affects Thunderbird < 91.4.0, Firefox ESR < 91.4.0, and Firefox < 95. CVE-2021-43546 openSUSE Tumbleweed:MozillaFirefox-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-95.0-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-95.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-43546.html CVE-2021-43546 https://bugzilla.suse.com/1193485 SUSE Bug 1193485