firefox-115.3.1-1.el9.ML.1

エラータID: AXSA:2023-6493:37

Release date: 
Thursday, October 12, 2023 - 01:10
Subject: 
firefox-115.3.1-1.el9.ML.1
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

This update upgrades Firefox to version 115.3.1 ESR.

Security Fix(es):

* firefox: use-after-free in workers (CVE-2023-3600)
* Mozilla: Out-of-bounds write in PathOps (CVE-2023-5169)
* Mozilla: Use-after-free in Ion Compiler (CVE-2023-5171)
* Mozilla: Memory safety bugs fixed in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3 (CVE-2023-5176)
* libvpx: Heap buffer overflow in vp8 encoding in libvpx (CVE-2023-5217)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2023-3600
During the worker lifecycle, a use-after-free condition could have occured, which could have led to a potentially exploitable crash. This vulnerability affects Firefox < 115.0.2, Firefox ESR < 115.0.2, and Thunderbird < 115.0.1.
CVE-2023-5169
A compromised content process could have provided malicious data in a `PathRecording` resulting in an out-of-bounds write, leading to a potentially exploitable crash in a privileged process. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
CVE-2023-5171
During Ion compilation, a Garbage Collection could have resulted in a use-after-free condition, allowing an attacker to write two NUL bytes, and cause a potentially exploitable crash. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
CVE-2023-5176
Memory safety bugs present in Firefox 117, Firefox ESR 115.2, and Thunderbird 115.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 118, Firefox ESR < 115.3, and Thunderbird < 115.3.
CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. firefox-115.3.1-1.el9.ML.1.src.rpm
    MD5: d339ef18314f43ad91f012b47f622789
    SHA-256: 5a149d9ad0746d62ea38de90e4697d451689f2bf6b255d2aabdcc50b026ddad1
    Size: 703.57 MB

Asianux Server 9 for x86_64
  1. firefox-115.3.1-1.el9.ML.1.x86_64.rpm
    MD5: 6819e7de4b37261b09ed8c27655f2c91
    SHA-256: da810e65aa262da2177d962da6d4e8b89a4e56eb114a64c32f5d95f824f821a3
    Size: 109.95 MB
  2. firefox-x11-115.3.1-1.el9.ML.1.x86_64.rpm
    MD5: a2788b3cf129c765d9e559eea3721515
    SHA-256: f1b4dc3d2e4b8493fe71851b5ad5f7354029a570d08a404c5c67db30fa670ea5
    Size: 13.99 kB