Bugzilla – Bug 1221850
VUL-0: MozillaFirefox / MozillaThunderbird: update to 124.0.1 and 115.9.1esr
Last modified: 2024-06-10 07:40:03 UTC
From upstream: > Firefox (along with Chrome, Edge, and Safari) was successfully > exploited at the pwn2own contest. We have patches and have validated > them, and are beginning builds. There are two bugs, a JS bug and a > sandbox escape. > > The JS bug does NOT affect ESR 115 but does affect mobile. > The Sandbox Escape DOES affect ESR 115 but does not affect mobile. Preliminary advisery: - Firefox Extended Support Release 115.9.1esr ESR MFSA 2024-16 * CVE-2024-29944 (bmo#1886852) Privileged JavaScript Execution via Event Handlers
Also preliminary: - Mozilla Firefox 124.0.1 MFSA 2024-15 * CVE-2024-29943 (bmo#1886849) Out-of-bounds access via Range Analysis bypass * CVE-2024-29944 (bmo#1886852) Privileged JavaScript Execution via Event Handlers
Martin, do you know when the public release is planned?
This is an autogenerated message for OBS integration: This bug (1221850) was mentioned in https://build.opensuse.org/request/show/1160726 Factory / MozillaFirefox
(In reply to Thomas Leroy from comment #3) > Martin, do you know when the public release is planned? It has been released on Friday.
SUSE-SU-2024:1000-1: An update that solves one vulnerability can now be installed. Category: security (critical) Bug References: 1221850 CVE References: CVE-2024-29944 Maintenance Incident: [SUSE:Maintenance:33034](https://smelt.suse.de/incident/33034/) Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): MozillaFirefox-115.9.1-112.206.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): MozillaFirefox-115.9.1-112.206.1 SUSE Linux Enterprise Server 12 SP5 (src): MozillaFirefox-115.9.1-112.206.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): MozillaFirefox-115.9.1-112.206.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2024:1002-1: An update that solves 19 vulnerabilities can now be installed. Category: security (critical) Bug References: 1220048, 1221327, 1221850 CVE References: CVE-2023-5388, CVE-2024-0743, CVE-2024-1546, CVE-2024-1547, CVE-2024-1548, CVE-2024-1549, CVE-2024-1550, CVE-2024-1551, CVE-2024-1552, CVE-2024-1553, CVE-2024-2605, CVE-2024-2607, CVE-2024-2608, CVE-2024-2610, CVE-2024-2611, CVE-2024-2612, CVE-2024-2614, CVE-2024-2616, CVE-2024-29944 Maintenance Incident: [SUSE:Maintenance:32985](https://smelt.suse.de/incident/32985/) Sources used: openSUSE Leap 15.5 (src): MozillaFirefox-115.9.1-150200.152.131.1 Desktop Applications Module 15-SP5 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): MozillaFirefox-115.9.1-150200.152.131.1 SUSE Enterprise Storage 7.1 (src): MozillaFirefox-115.9.1-150200.152.131.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
making the bug public