Advisories » MGASA-2023-0308

Updated nss and firefox packages fix security vulnerabilities

Publication date: 06 Nov 2023
Modification date: 06 Nov 2023
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-5721 , CVE-2023-5732 , CVE-2023-5724 , CVE-2023-5725 , CVE-2023-5728 , CVE-2023-5730

Description

The updated packages fix security vulnerabilities:

Queued up rendering could have allowed websites to clickjack.
(CVE-2023-5721)

Address bar spoofing via bidirectional characters. (CVE-2023-5732)

Large WebGL draw could have led to a crash. (CVE-2023-5724)

WebExtensions could open arbitrary URLs. (CVE-2023-5725)

Improper object tracking during GC in the JavaScript engine could have
led to a crash. (CVE-2023-5728)

Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and
Thunderbird 115.4.1. (CVE-2023-5730)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=32477
• https://www.mozilla.org/en-US/firefox/115.4.0/releasenotes/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/
• https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_94.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5721
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5732
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5724
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5725
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5728
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5730

SRPMS

9/core

• nss-3.94.0-1.mga9
• firefox-115.4.0-1.mga9
• firefox-l10n-115.4.0-1.mga9