Bugzilla – Bug 1202645
VUL-0: MozillaFirefox / MozillaThunderbird: update to 104 and 102.2esr/91.13esr
Last modified: 2022-09-26 19:31:56 UTC
- Mozilla Firefox 104 MFSA 2022-33 (bsc#) * CVE-2022-38472 (bmo#1769155) Address bar spoofing via XSLT error handling * CVE-2022-38473 (bmo#1771685) Cross-origin XSLT Documents would have inherited the parent's permissions * CVE-2022-38474 (bmo#1719511) Recording notification not shown when microphone was recording on Android * CVE-2022-38475 (bmo#1773266) Attacker could write a value to a zero-length array * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363) Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 * CVE-2022-38478 (bmo#1770630, bmo#1776658) Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13 - Mozilla Firefox ESR 91.13 MFSA 2022-35 (bsc#) * CVE-2022-38472 (bmo#1769155) Address bar spoofing via XSLT error handling * CVE-2022-38473 (bmo#1771685) Cross-origin XSLT Documents would have inherited the parent's permissions * CVE-2022-38478 (bmo#1770630, bmo#1776658) Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13 - Mozilla Firefox ESR 102.2 MFSA 2022-34 (bsc#) * CVE-2022-38472 (bmo#1769155) Address bar spoofing via XSLT error handling * CVE-2022-38473 (bmo#1771685) Cross-origin XSLT Documents would have inherited the parent's permissions * CVE-2022-38476 (bmo#1760998) Data race and potential use-after-free in PK11_ChangePW * CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159, bmo#1773363) Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2 * CVE-2022-38478 (bmo#1770630, bmo#1776658) Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2, and Firefox ESR 91.13
This is an autogenerated message for OBS integration: This bug (1202645) was mentioned in https://build.opensuse.org/request/show/999342 Factory / MozillaFirefox https://build.opensuse.org/request/show/999347 Factory / MozillaThunderbird
SUSE-RU-2022:2939-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1201298,1202645 CVE References: JIRA References: Sources used: openSUSE Leap 15.4 (src): mozilla-nss-3.79.1-150400.3.10.2 SUSE Linux Enterprise Module for Basesystem 15-SP4 (src): mozilla-nss-3.79.1-150400.3.10.2 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2984-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1202645 CVE References: CVE-2022-38472,CVE-2022-38473,CVE-2022-38478 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise Server for SAP 15 (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise Server 15-LTSS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE Enterprise Storage 6 (src): MozillaFirefox-91.13.0-150000.150.53.1 SUSE CaaS Platform 4.0 (src): MozillaFirefox-91.13.0-150000.150.53.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-RU-2022:3000-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1201298,1202645 CVE References: JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): mozilla-nss-3.79.1-58.78.1 SUSE OpenStack Cloud 9 (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Server 12-SP5 (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): mozilla-nss-3.79.1-58.78.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): mozilla-nss-3.79.1-58.78.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3007-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1202645 CVE References: CVE-2022-38472,CVE-2022-38473,CVE-2022-38478 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): MozillaFirefox-91.13.0-112.127.4 SUSE OpenStack Cloud 9 (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Server for SAP 12-SP4 (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Server 12-SP5 (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Server 12-SP4-LTSS (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Server 12-SP3-BCL (src): MozillaFirefox-91.13.0-112.127.4 SUSE Linux Enterprise Server 12-SP2-BCL (src): MozillaFirefox-91.13.0-112.127.4 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done (left over update is going out now)
SUSE-SU-2022:3030-1: An update that fixes three vulnerabilities is now available. Category: security (important) Bug References: 1202645 CVE References: CVE-2022-38472,CVE-2022-38473,CVE-2022-38478 JIRA References: Sources used: openSUSE Leap 15.4 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 openSUSE Leap 15.3 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Manager Server 4.1 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Manager Retail Branch Server 4.1 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Manager Proxy 4.1 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 SUSE Enterprise Storage 7 (src): MozillaFirefox-91.13.0-150200.152.56.2, MozillaFirefox-branding-SLE-91-150200.9.7.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-RU-2022:3091-1: An update that has two recommended fixes can now be installed. Category: recommended (moderate) Bug References: 1201298,1202645 CVE References: JIRA References: Sources used: openSUSE Leap Micro 5.2 (src): mozilla-nss-3.79.1-150000.3.77.1 openSUSE Leap 15.3 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Manager Server 4.1 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Manager Retail Branch Server 4.1 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Manager Proxy 4.1 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server for SAP 15 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Server 15-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Micro 5.2 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise Micro 5.1 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Enterprise Storage 7 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE Enterprise Storage 6 (src): mozilla-nss-3.79.1-150000.3.77.1 SUSE CaaS Platform 4.0 (src): mozilla-nss-3.79.1-150000.3.77.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3272-1: An update that fixes 28 vulnerabilities is now available. Category: security (important) Bug References: 1200793,1201758,1202645 CVE References: CVE-2022-2200,CVE-2022-2505,CVE-2022-34468,CVE-2022-34469,CVE-2022-34470,CVE-2022-34471,CVE-2022-34472,CVE-2022-34473,CVE-2022-34474,CVE-2022-34475,CVE-2022-34476,CVE-2022-34477,CVE-2022-34478,CVE-2022-34479,CVE-2022-34480,CVE-2022-34481,CVE-2022-34482,CVE-2022-34483,CVE-2022-34484,CVE-2022-34485,CVE-2022-36314,CVE-2022-36318,CVE-2022-36319,CVE-2022-38472,CVE-2022-38473,CVE-2022-38476,CVE-2022-38477,CVE-2022-38478 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15-SP1 (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise Server for SAP 15 (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise Server 15-LTSS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE Enterprise Storage 6 (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 SUSE CaaS Platform 4.0 (src): MozillaFirefox-102.2.0-150000.150.56.1, MozillaFirefox-branding-SLE-102-150000.4.22.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3273-1: An update that fixes 28 vulnerabilities is now available. Category: security (important) Bug References: 1200793,1201758,1202645 CVE References: CVE-2022-2200,CVE-2022-2505,CVE-2022-34468,CVE-2022-34469,CVE-2022-34470,CVE-2022-34471,CVE-2022-34472,CVE-2022-34473,CVE-2022-34474,CVE-2022-34475,CVE-2022-34476,CVE-2022-34477,CVE-2022-34478,CVE-2022-34479,CVE-2022-34480,CVE-2022-34481,CVE-2022-34482,CVE-2022-34483,CVE-2022-34484,CVE-2022-34485,CVE-2022-36314,CVE-2022-36318,CVE-2022-36319,CVE-2022-38472,CVE-2022-38473,CVE-2022-38476,CVE-2022-38477,CVE-2022-38478 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE OpenStack Cloud 9 (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): MozillaFirefox-102.2.0-112.130.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE Linux Enterprise Server 12-SP5 (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): MozillaFirefox-102.2.0-112.130.1, MozillaFirefox-branding-SLE-102-35.9.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3281-1: An update that fixes 23 vulnerabilities is now available. Category: security (important) Bug References: 1200793,1201758,1202645,1203007 CVE References: CVE-2022-2200,CVE-2022-2226,CVE-2022-2505,CVE-2022-3032,CVE-2022-3033,CVE-2022-3034,CVE-2022-31744,CVE-2022-34468,CVE-2022-34470,CVE-2022-34472,CVE-2022-34478,CVE-2022-34479,CVE-2022-34481,CVE-2022-34484,CVE-2022-36059,CVE-2022-36314,CVE-2022-36318,CVE-2022-36319,CVE-2022-38472,CVE-2022-38473,CVE-2022-38476,CVE-2022-38477,CVE-2022-38478 JIRA References: Sources used: openSUSE Leap 15.4 (src): MozillaThunderbird-102.2.2-150200.8.82.1 openSUSE Leap 15.3 (src): MozillaThunderbird-102.2.2-150200.8.82.1 SUSE Linux Enterprise Workstation Extension 15-SP4 (src): MozillaThunderbird-102.2.2-150200.8.82.1 SUSE Linux Enterprise Workstation Extension 15-SP3 (src): MozillaThunderbird-102.2.2-150200.8.82.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP4 (src): MozillaThunderbird-102.2.2-150200.8.82.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): MozillaThunderbird-102.2.2-150200.8.82.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:3396-1: An update that fixes 34 vulnerabilities is now available. Category: security (important) Bug References: 1200793,1201758,1202645,1203477 CVE References: CVE-2022-2200,CVE-2022-2505,CVE-2022-34468,CVE-2022-34469,CVE-2022-34470,CVE-2022-34471,CVE-2022-34472,CVE-2022-34473,CVE-2022-34474,CVE-2022-34475,CVE-2022-34476,CVE-2022-34477,CVE-2022-34478,CVE-2022-34479,CVE-2022-34480,CVE-2022-34481,CVE-2022-34482,CVE-2022-34483,CVE-2022-34484,CVE-2022-34485,CVE-2022-36314,CVE-2022-36318,CVE-2022-36319,CVE-2022-38472,CVE-2022-38473,CVE-2022-38476,CVE-2022-38477,CVE-2022-38478,CVE-2022-40956,CVE-2022-40957,CVE-2022-40958,CVE-2022-40959,CVE-2022-40960,CVE-2022-40962 JIRA References: Sources used: openSUSE Leap 15.4 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 openSUSE Leap 15.3 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Manager Server 4.1 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Manager Retail Branch Server 4.1 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Manager Proxy 4.1 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP4 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise Module for Desktop Applications 15-SP3 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 SUSE Enterprise Storage 7 (src): MozillaFirefox-102.3.0-150200.152.61.1, MozillaFirefox-branding-SLE-102-150200.9.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.