MGASA-2023-0308 - Updated nss and firefox packages fix security vulnerabilities

Publication date: 06 Nov 2023
URL: https://advisories.mageia.org/MGASA-2023-0308.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2023-5721,
     CVE-2023-5732,
     CVE-2023-5724,
     CVE-2023-5725,
     CVE-2023-5728,
     CVE-2023-5730

The updated packages fix security vulnerabilities:

Queued up rendering could have allowed websites to clickjack.
(CVE-2023-5721)

Address bar spoofing via bidirectional characters. (CVE-2023-5732)

Large WebGL draw could have led to a crash. (CVE-2023-5724)

WebExtensions could open arbitrary URLs. (CVE-2023-5725)

Improper object tracking during GC in the JavaScript engine could have
led to a crash. (CVE-2023-5728)

Memory safety bugs fixed in Firefox 119, Firefox ESR 115.4, and
Thunderbird 115.4.1. (CVE-2023-5730)

References:
- https://bugs.mageia.org/show_bug.cgi?id=32477
- https://www.mozilla.org/en-US/firefox/115.4.0/releasenotes/
- https://www.mozilla.org/en-US/security/advisories/mfsa2023-46/
- https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_94.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5721
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5732
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5724
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5725
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5728
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-5730

SRPMS:
- 9/core/nss-3.94.0-1.mga9
- 9/core/firefox-115.4.0-1.mga9
- 9/core/firefox-l10n-115.4.0-1.mga9