MozillaFirefox-108.0.1-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2024:12577 Final 1 1 2024-06-17T21:45:33Z current 2024-06-17T21:45:33Z 2024-06-17T21:45:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z MozillaFirefox-108.0.1-1.1 on GA media These are all security issues fixed in the MozillaFirefox-108.0.1-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2024-12577 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) E-Mail link for openSUSE-SU-2024:12577 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2022-46871/ SUSE CVE CVE-2022-46871 page https://www.suse.com/security/cve/CVE-2022-46872/ SUSE CVE CVE-2022-46872 page https://www.suse.com/security/cve/CVE-2022-46873/ SUSE CVE CVE-2022-46873 page https://www.suse.com/security/cve/CVE-2022-46874/ SUSE CVE CVE-2022-46874 page https://www.suse.com/security/cve/CVE-2022-46875/ SUSE CVE CVE-2022-46875 page https://www.suse.com/security/cve/CVE-2022-46877/ SUSE CVE CVE-2022-46877 page https://www.suse.com/security/cve/CVE-2022-46878/ SUSE CVE CVE-2022-46878 page https://www.suse.com/security/cve/CVE-2022-46879/ SUSE CVE CVE-2022-46879 page openSUSE Tumbleweed MozillaFirefox-108.0.1-1.1 MozillaFirefox-branding-upstream-108.0.1-1.1 MozillaFirefox-devel-108.0.1-1.1 MozillaFirefox-translations-common-108.0.1-1.1 MozillaFirefox-translations-other-108.0.1-1.1 MozillaFirefox-108.0.1-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-branding-upstream-108.0.1-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-devel-108.0.1-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-translations-common-108.0.1-1.1 as a component of openSUSE Tumbleweed MozillaFirefox-translations-other-108.0.1-1.1 as a component of openSUSE Tumbleweed An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. CVE-2022-46871 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46871.html CVE-2022-46871 An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46872 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46872.html CVE-2022-46872 Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constrained by the specified Content Security Policy of the document. This vulnerability affects Firefox < 108. CVE-2022-46873 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46873.html CVE-2022-46873 A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6. CVE-2022-46874 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46874.html CVE-2022-46874 https://bugzilla.suse.com/1206653 SUSE Bug 1206653 The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46875 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46875.html CVE-2022-46875 By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108. CVE-2022-46877 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46877.html CVE-2022-46877 Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6. CVE-2022-46878 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 critical To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46878.html CVE-2022-46878 Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108. CVE-2022-46879 openSUSE Tumbleweed:MozillaFirefox-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-branding-upstream-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-devel-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-common-108.0.1-1.1 openSUSE Tumbleweed:MozillaFirefox-translations-other-108.0.1-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-46879.html CVE-2022-46879