ALSA-2022:6702 - Important: Firefox Security Update
Summary
ALSA-2022:6702: Important: firefox security update. Affects firefox versions < 102.3.0-6.el8_6.alma. Fixed in 102.3.0-6.el8_6.alma. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mozilla Firefox is an open-source web browser known for its compliance with web standards, performance, and portability. It is widely used by individuals and organizations for browsing the internet. The vulnerability discussed in this report affects the Firefox package in AlmaLinux 8.
Vulnerability Detail
The vulnerability (CVE-2022-40959) allows bypassing FeaturePolicy restrictions on transient pages. This can potentially lead to unauthorized access or execution of malicious code. Another vulnerability (CVE-2022-40960) involves a data race when parsing non-UTF-8 URLs in threads, which may result in unexpected behavior or crashes. Additionally, memory safety bugs fixed in Firefox 105 and Firefox ESR 102.3 (CVE-2022-40962) could be exploited to execute arbitrary code or cause denial of service. The vulnerability (CVE-2022-40958) enables bypassing the Secure Context restriction for cookies with __Host and __Secure prefix, potentially leading to session hijacking or information disclosure. Another vulnerability (CVE-2022-40956) allows bypassing the Content-Security-Policy base-uri restriction, which may enable cross-site scripting attacks. Lastly, the vulnerability (CVE-2022-40957) involves an incoherent instruction cache when building WebAssembly on ARM64, which could result in incorrect execution of code.
How To Fix
Minimum fixed version
102.3.0-6.el8_6.alma
This is the first release that contains the fix.
sudo dnf update firefoxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Mozilla Firefox has released a security update (version 102.3.0 ESR) to address multiple vulnerabilities. It is crucial to update the Firefox package to the recommended version or later to mitigate the risk of exploitation. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for firefox →
FAQ
Mozilla Firefox is an open-source web browser known for its compliance with web standards, performance, and portability.
CVE-2022-40959 allows bypassing FeaturePolicy restrictions on transient pages, potentially leading to unauthorized access or execution of malicious code.
To fix the vulnerability, update the Firefox package to version 102.3.0-6.el8_6.alma or later using the appropriate package manager command.
No specific workarounds have been provided for this vulnerability.
For more details about the security issues, including impact, CVSS score, acknowledgments, and related information, refer to the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for firefox.
