Bug 1211922 - VUL-0: MozillaFirefox / MozillaThunderbird: update to 114 and 102.12esr
Summary: VUL-0: MozillaFirefox / MozillaThunderbird: update to 114 and 102.12esr
Status: RESOLVED FIXED
Alias: None
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Martin Sirringhaus
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/368113/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-34414:7.5:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-06-01 14:16 UTC by Martin Sirringhaus
Modified: 2024-02-27 11:59 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 3 Martin Sirringhaus 2023-06-06 12:31:57 UTC 
- Mozilla Firefox ESR 102.12
  MFSA 2023-19
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12

- Mozilla Firefox 114
  MFSA 2023-18
  * CVE-2023-34414 (bmo#1695986)
    Click-jacking certificate exceptions through rendering lag
  * CVE-2023-34415 (bmo#1811999)
    Site-isolation bypass on sites that allow open redirects to
    data: urls
  * CVE-2023-34416 (bmo#1752703, bmo#1818394, bmo#1826875,
    bmo#1827340, bmo#1827655, bmo#1828065, bmo#1830190,
    bmo#1830206, bmo#1830795, bmo#1833339)
    Memory safety bugs fixed in Firefox 114 and Firefox ESR
    102.12
  * CVE-2023-34417 (bmo#1746447, bmo#1820903, bmo#1832832)
    Memory safety bugs fixed in Firefox 114
Comment 4 Maintenance Automation 2023-06-07 12:30:17 UTC 
SUSE-SU-2023:2441-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211922
CVE References: CVE-2023-34414, CVE-2023-34416
Sources used:
SUSE OpenStack Cloud 9 (src): MozillaFirefox-102.12.0-112.162.1
SUSE OpenStack Cloud Crowbar 9 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server for SAP Applications 12 SP4 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Software Development Kit 12 SP5 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server 12 SP5 (src): MozillaFirefox-102.12.0-112.162.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): MozillaFirefox-102.12.0-112.162.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Maintenance Automation 2023-06-07 12:30:19 UTC 
SUSE-SU-2023:2440-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211922
CVE References: CVE-2023-34414, CVE-2023-34416
Sources used:
SUSE Linux Enterprise Server 15 SP1 LTSS 15-SP1 (src): MozillaFirefox-102.12.0-150000.150.88.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1 (src): MozillaFirefox-102.12.0-150000.150.88.1
SUSE CaaS Platform 4.0 (src): MozillaFirefox-102.12.0-150000.150.88.1
SUSE Linux Enterprise High Performance Computing 15 SP1 LTSS 15-SP1 (src): MozillaFirefox-102.12.0-150000.150.88.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 7 Maintenance Automation 2023-06-12 16:30:01 UTC 
SUSE-SU-2023:2489-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211922
CVE References: CVE-2023-34414, CVE-2023-34416
Sources used:
openSUSE Leap 15.4 (src): MozillaFirefox-102.12.0-150200.152.90.1
openSUSE Leap 15.5 (src): MozillaFirefox-102.12.0-150200.152.90.1
Desktop Applications Module 15-SP4 (src): MozillaFirefox-102.12.0-150200.152.90.1
Desktop Applications Module 15-SP5 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise Real Time 15 SP3 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Enterprise Storage 7.1 (src): MozillaFirefox-102.12.0-150200.152.90.1
SUSE Enterprise Storage 7 (src): MozillaFirefox-102.12.0-150200.152.90.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 10 Marcus Meissner 2024-01-24 15:29:53 UTC 
done
Comment 11 Maintenance Automation 2024-02-27 11:59:55 UTC 
SUSE-SU-2023:2612-1: An update that solves two vulnerabilities can now be installed.

Category: security (important)
Bug References: 1211922
CVE References: CVE-2023-34414, CVE-2023-34416
Sources used:
openSUSE Leap 15.4 (src): MozillaThunderbird-102.12.0-150200.8.121.1
openSUSE Leap 15.5 (src): MozillaThunderbird-102.12.0-150200.8.121.1
SUSE Package Hub 15 15-SP4 (src): MozillaThunderbird-102.12.0-150200.8.121.1
SUSE Package Hub 15 15-SP5 (src): MozillaThunderbird-102.12.0-150200.8.121.1
SUSE Linux Enterprise Workstation Extension 15 SP4 (src): MozillaThunderbird-102.12.0-150200.8.121.1
SUSE Linux Enterprise Workstation Extension 15 SP5 (src): MozillaThunderbird-102.12.0-150200.8.121.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.