Bug 1221850

Summary: VUL-0: MozillaFirefox / MozillaThunderbird: update to 124.0.1 and 115.9.1esr
Product: [Novell Products] SUSE Security Incidents Reporter: Martin Sirringhaus <martin.sirringhaus>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: NEW --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: rfrohl, thomas.leroy, wolfgang
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/398644/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-29943:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv3.1:SUSE:CVE-2024-29944:8.8:(AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Martin Sirringhaus 2024-03-22 08:05:39 UTC
From upstream:

> Firefox (along with Chrome, Edge, and Safari) was successfully
> exploited at the pwn2own contest.  We have patches and have validated
> them, and are beginning builds. There are two bugs, a JS bug and a
> sandbox escape.
> 
> The JS bug does NOT affect ESR 115 but does affect mobile.
> The Sandbox Escape DOES affect ESR 115 but does not affect mobile.

Preliminary advisery:
- Firefox Extended Support Release 115.9.1esr ESR
  MFSA 2024-16
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers
Comment 1 Martin Sirringhaus 2024-03-22 08:06:40 UTC
Also preliminary:

- Mozilla Firefox 124.0.1
  MFSA 2024-15
  * CVE-2024-29943 (bmo#1886849)
    Out-of-bounds access via Range Analysis bypass
  * CVE-2024-29944 (bmo#1886852)
    Privileged JavaScript Execution via Event Handlers
Comment 3 Thomas Leroy 2024-03-22 14:54:51 UTC
Martin, do you know when the public release is planned?
Comment 4 OBSbugzilla Bot 2024-03-22 17:35:03 UTC
This is an autogenerated message for OBS integration:
This bug (1221850) was mentioned in
https://build.opensuse.org/request/show/1160726 Factory / MozillaFirefox
Comment 5 Martin Sirringhaus 2024-03-25 07:28:44 UTC
(In reply to Thomas Leroy from comment #3)
> Martin, do you know when the public release is planned?

It has been released on Friday.
Comment 6 Maintenance Automation 2024-03-26 16:30:03 UTC
SUSE-SU-2024:1000-1: An update that solves one vulnerability can now be installed.

Category: security (critical)
Bug References: 1221850
CVE References: CVE-2024-29944
Maintenance Incident: [SUSE:Maintenance:33034](https://smelt.suse.de/incident/33034/)
Sources used:
SUSE Linux Enterprise Software Development Kit 12 SP5 (src):
 MozillaFirefox-115.9.1-112.206.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src):
 MozillaFirefox-115.9.1-112.206.1
SUSE Linux Enterprise Server 12 SP5 (src):
 MozillaFirefox-115.9.1-112.206.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src):
 MozillaFirefox-115.9.1-112.206.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2024-03-27 08:30:04 UTC
SUSE-SU-2024:1002-1: An update that solves 19 vulnerabilities can now be installed.

Category: security (critical)
Bug References: 1220048, 1221327, 1221850
CVE References: CVE-2023-5388, CVE-2024-0743, CVE-2024-1546, CVE-2024-1547, CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1551, CVE-2024-1552, CVE-2024-1553, CVE-2024-2605, CVE-2024-2607, CVE-2024-2608, CVE-2024-2610, CVE-2024-2611, CVE-2024-2612, CVE-2024-2614, CVE-2024-2616, CVE-2024-29944
Maintenance Incident: [SUSE:Maintenance:32985](https://smelt.suse.de/incident/32985/)
Sources used:
openSUSE Leap 15.5 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
Desktop Applications Module 15-SP5 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src):
 MozillaFirefox-115.9.1-150200.152.131.1
SUSE Enterprise Storage 7.1 (src):
 MozillaFirefox-115.9.1-150200.152.131.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 8 Robert Frohl 2024-04-03 09:42:47 UTC
making the bug public