| Description: | Summary:
The remote host is missing an update for the 'MozillaFirefox'
package(s) announced via the SUSE-SU-2023:4928-1 advisory.
Vulnerability Insight:
This update for MozillaFirefox fixes the following issues:
* Firefox Extended Support Release 115.6.0 ESR changelog-entry (bsc#1217974).
* CVE-2023-6856: Heap-buffer-overflow affecting WebGL DrawElementsInstanced
method with Mesa VM driver (bmo#1843782).
* CVE-2023-6857: Symlinks may resolve to smaller than expected buffers
(bmo#1796023).
* CVE-2023-6858: Heap buffer overflow in nsTextFragment (bmo#1826791).
* CVE-2023-6859: Use-after-free in PR_GetIdentitiesLayer (bmo#1840144).
* CVE-2023-6860: Potential sandbox escape due to VideoBridge lack of texture
validation (bmo#1854669).
* CVE-2023-6861: Heap buffer overflow affected nsWindow::PickerOpen(void) in
headless mode (bmo#1864118).
* CVE-2023-6862: Use-after-free in nsDNSService (bsc#1868042).
* CVE-2023-6863: Undefined behavior in ShutdownObserver() (bmo#1868901).
* CVE-2023-6864: Memory safety bugs fixed in Firefox 121, Firefox ESR 115.6,
and Thunderbird 115.6.
* CVE-2023-6865: Potential exposure of uninitialized data in
EncryptingOutputStream (bmo#1864123).
* CVE-2023-6867: Clickjacking permission prompts using the popup transition
(bmo#1863863).
* Fixed: Various security fixes and other quality improvements MFSA 2023-50
(bsc#1217230)
* CVE-2023-6204 (bmo#1841050) Out-of-bound memory access in WebGL2
blitFramebuffer
* CVE-2023-6205 (bmo#1854076) Use-after-free in MessagePort::Entangled
* CVE-2023-6206 (bmo#1857430) Clickjacking permission prompts using the
fullscreen transition
* CVE-2023-6207 (bmo#1861344) Use-after-free in
ReadableByteStreamQueueEntry::Buffer
* CVE-2023-6208 (bmo#1855345) Using Selection API would copy contents into X11
primary selection.
* CVE-2023-6209 (bmo#1858570) Incorrect parsing of relative URLs starting with
'///'
* CVE-2023-6212 (bmo#1658432, bmo#1820983, bmo#1829252, bmo#1856072,
bmo#1856091, bmo#1859030, bmo#1860943, bmo#1862782) Memory safety bugs fixed
in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5
##
Affected Software/OS:
'MozillaFirefox' package(s) on openSUSE Leap 15.4, openSUSE Leap 15.5.
Solution:
Please install the updated package(s).
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
