Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.6101
firefox security update
23 November 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: firefox
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2022-45421 CVE-2022-45420 CVE-2022-45418
CVE-2022-45416 CVE-2022-45412 CVE-2022-45411
CVE-2022-45410 CVE-2022-45409 CVE-2022-45408
CVE-2022-45406 CVE-2022-45405 CVE-2022-45404
CVE-2022-45403
Original Bulletin:
https://access.redhat.com/errata/RHSA-2022:8580
Comment: CVSS (Max): 7.5 CVE-2022-45421 (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: firefox security update
Advisory ID: RHSA-2022:8580-02
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8580
Issue date: 2022-11-22
CVE Names: CVE-2022-45403 CVE-2022-45404 CVE-2022-45405
CVE-2022-45406 CVE-2022-45408 CVE-2022-45409
CVE-2022-45410 CVE-2022-45411 CVE-2022-45412
CVE-2022-45416 CVE-2022-45418 CVE-2022-45420
CVE-2022-45421
=====================================================================
1. Summary:
An update for firefox is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
3. Description:
Mozilla Firefox is an open-source web browser, designed for standards
compliance, performance, and portability.
This update upgrades Firefox to version 102.5.0 ESR.
Security Fix(es):
* Mozilla: Service Workers might have learned size of cross-origin media
files (CVE-2022-45403)
* Mozilla: Fullscreen notification bypass (CVE-2022-45404)
* Mozilla: Use-after-free in InputStream implementation (CVE-2022-45405)
* Mozilla: Use-after-free of a JavaScript Realm (CVE-2022-45406)
* Mozilla: Fullscreen notification bypass via windowName (CVE-2022-45408)
* Mozilla: Use-after-free in Garbage Collection (CVE-2022-45409)
* Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
(CVE-2022-45421)
* Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie
policy (CVE-2022-45410)
* Mozilla: Cross-Site Tracing was possible via non-standard override
headers (CVE-2022-45411)
* Mozilla: Symlinks may resolve to partially uninitialized buffers
(CVE-2022-45412)
* Mozilla: Keystroke Side-Channel Leakage (CVE-2022-45416)
* Mozilla: Custom mouse cursor could have been drawn over browser UI
(CVE-2022-45418)
* Mozilla: Iframe contents could be rendered outside the iframe
(CVE-2022-45420)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
After installing the update, Firefox must be restarted for the changes to
take effect.
5. Bugs fixed (https://bugzilla.redhat.com/):
2143197 - CVE-2022-45403 Mozilla: Service Workers might have learned size of cross-origin media files
2143198 - CVE-2022-45404 Mozilla: Fullscreen notification bypass
2143199 - CVE-2022-45405 Mozilla: Use-after-free in InputStream implementation
2143200 - CVE-2022-45406 Mozilla: Use-after-free of a JavaScript Realm
2143201 - CVE-2022-45408 Mozilla: Fullscreen notification bypass via windowName
2143202 - CVE-2022-45409 Mozilla: Use-after-free in Garbage Collection
2143203 - CVE-2022-45410 Mozilla: ServiceWorker-intercepted requests bypassed SameSite cookie policy
2143204 - CVE-2022-45411 Mozilla: Cross-Site Tracing was possible via non-standard override headers
2143205 - CVE-2022-45412 Mozilla: Symlinks may resolve to partially uninitialized buffers
2143240 - CVE-2022-45416 Mozilla: Keystroke Side-Channel Leakage
2143241 - CVE-2022-45418 Mozilla: Custom mouse cursor could have been drawn over browser UI
2143242 - CVE-2022-45420 Mozilla: Iframe contents could be rendered outside the iframe
2143243 - CVE-2022-45421 Mozilla: Memory safety bugs fixed in Firefox 107 and Firefox ESR 102.5
6. Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
firefox-102.5.0-1.el9_1.src.rpm
aarch64:
firefox-102.5.0-1.el9_1.aarch64.rpm
firefox-debuginfo-102.5.0-1.el9_1.aarch64.rpm
firefox-debugsource-102.5.0-1.el9_1.aarch64.rpm
ppc64le:
firefox-102.5.0-1.el9_1.ppc64le.rpm
firefox-debuginfo-102.5.0-1.el9_1.ppc64le.rpm
firefox-debugsource-102.5.0-1.el9_1.ppc64le.rpm
s390x:
firefox-102.5.0-1.el9_1.s390x.rpm
firefox-debuginfo-102.5.0-1.el9_1.s390x.rpm
firefox-debugsource-102.5.0-1.el9_1.s390x.rpm
x86_64:
firefox-102.5.0-1.el9_1.x86_64.rpm
firefox-debuginfo-102.5.0-1.el9_1.x86_64.rpm
firefox-debugsource-102.5.0-1.el9_1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-45403
https://access.redhat.com/security/cve/CVE-2022-45404
https://access.redhat.com/security/cve/CVE-2022-45405
https://access.redhat.com/security/cve/CVE-2022-45406
https://access.redhat.com/security/cve/CVE-2022-45408
https://access.redhat.com/security/cve/CVE-2022-45409
https://access.redhat.com/security/cve/CVE-2022-45410
https://access.redhat.com/security/cve/CVE-2022-45411
https://access.redhat.com/security/cve/CVE-2022-45412
https://access.redhat.com/security/cve/CVE-2022-45416
https://access.redhat.com/security/cve/CVE-2022-45418
https://access.redhat.com/security/cve/CVE-2022-45420
https://access.redhat.com/security/cve/CVE-2022-45421
https://access.redhat.com/security/updates/classification/#important
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY30bJNzjgjWX9erEAQjMNg/+LNWOOp0chbfCOhhzud7rJUwhYExagD6i
KtRJCOwVZ50PAcqZ3DD9s53GNTOifh5S2jt+I71o7Aw4SM2oZW6xhsQvYAcxQy6s
KIbhxwflouzjsQfOPhFoz8NVp8Ky5cY4cESwmvFUEMZIbTlaUZvoD+fDnDT/USVJ
8kmeyeyEHtKhiuV+vzmMIg7bDbmElFj0nSo5T2LxNCuy12M3dYM9CfXAjea+C4lu
IgwnNx/AyhUvJgr4DkSNFGzKbKsH0WQ5PAHndftbDIVYnAYzpEwmx1mvYAcP5+C5
dfESQO0VSf90ibIbmHvl5MuUwrN6N9/OC0do6TO2LnnELOqO8OhSa+TYCCVtZ5kc
NBDfWUCbdG9w1niuR9XwTLS/agAsc8uD293aPi1mOJd/5nQtHlBvnv9CIjCxB/X1
SnzhwS8TeuBvm4x9ZlQJJL/IAfC+joVX4q4Hc6qVdkuYMvo94n5UkSrcve7JHuSD
66hFa4LJslEG/U79gTQBNYCen9ux6UDQ9VZ9DzP0GfHSAowFMKIj90Jrko2skSuM
+exfsYEZ7wVvyyPZnY5/KPn+mgMgkXq8ATsk99meWr+fVLfoabstt1v3vsnz+zgY
nthxvl5TCj26uudlbbKHR+26KPXVEbROLa4OQ6LghBbleIuhnSp5+tuDqSG2JxVJ
hB/k4b3CqhA=
=5TAs
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY313MMkNZI30y1K9AQhDMg/9E4gw+j1nM8/WUImNMMdQ/w7ouXg5PiKR
eF3d0Zdwd70wiGetm7vp58NGaKROz3HLAXEroNvU88XPmhwjjIe+EETkKe3bQBLG
3BnkRujlJW3JjP+My3oT2mEsS4bOGzcUHN327DCfMt2q9vZqDEe+/bWJHlrVK6Or
TMpA8gtg5X6W3d3EiDzbk9/zmT/7H6deGEudMiuMoINc3x442U/F6746rGmPrRwg
GN1yhthRfPGnPB3UFm/DcsfLlz3Qp1J+aUezhyyhW9vpg2y/5+r4KRX+3/N3jQZa
JNCagtV0nYIm1pZ9Mpk2EgJZ502feTNXYLlWCqsoiFVGavJwfYEjaO5KhtLVovKp
VX1ywNOU57pqjlRyn8FV/hyxoJozOhZqlT/SvS5PvaA18y2Lus89kysm9nMXS/u2
oYfx3pGhvm9ktdHrKFJmXww537Qo+DoHy0uq57N0GB0Y93ex1qEYL+g8RLowrp5N
T1P8W8cuIBW5pvYB71Kx5ww7rz5aY2+UeK+hvJbIFejrnFBE3jE9/eEz8oWDZvWo
Dw0chICxjiREtEBJy3elcAL/Tl9Y7gBhhjXqvAx6qGSXgOdzAC1Rp3i8D7BoiCSb
3DcuMEck5BGQV8srXjHXNd9Uq0hu0MZJVYqFQhSS/woW7hMHyfOyYUyjmB4srV3n
W5eo247fzps=
=Ujpa
-----END PGP SIGNATURE-----