SUSE alert SUSE-SU-2023:2959-1 (firefox)
| From: | sle-security-updates@lists.suse.com | |
| To: | sle-security-updates@lists.suse.com | |
| Subject: | SUSE-SU-2023:2959-1: important: Security update for MozillaFirefox | |
| Date: | Tue, 25 Jul 2023 08:49:55 -0000 | |
| Message-ID: | <169027499589.20574.488952892192852343@smelt2.suse.de> |
# Security update for MozillaFirefox Announcement ID: SUSE-SU-2023:2959-1 Rating: important References: * #1213230 Cross-References: * CVE-2023-3600 CVSS scores: * CVE-2023-3600 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2023-3600 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: * SUSE Linux Enterprise High Performance Computing 12 SP2 * SUSE Linux Enterprise High Performance Computing 12 SP4 * SUSE Linux Enterprise High Performance Computing 12 SP5 * SUSE Linux Enterprise Server 12 SP2 * SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 * SUSE Linux Enterprise Server 12 SP4 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 * SUSE Linux Enterprise Server 12 SP5 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 * SUSE Linux Enterprise Software Development Kit 12 SP5 * SUSE OpenStack Cloud 9 * SUSE OpenStack Cloud Crowbar 9 An update that solves one vulnerability can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 115.0.2 ESR (MFSA 2023-26, bsc#1213230) Security fixes: * CVE-2023-3600: Fixed use-after-free in workers (bmo#1839703) Other fixes: * Fixed a startup crash experienced by some Windows users by blocking instances of a malicious injected DLL (bmo#1841751) * Fixed a bug with displaying a caret in the text editor on some websites (bmo#1840804) * Fixed a bug with broken audio rendering on some websites (bmo#1841982) * Fixed a bug with patternTransform translate using the wrong units (bmo#1840746) * Fixed a crash affecting Windows 7 users related to the DLL blocklist. Firefox Extended Support Release 115.0.1 ESR * Fixed a startup crash for Windows users with Kingsoft Antivirus software installed (bmo#1837242) ## Patch Instructions: To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE OpenStack Cloud Crowbar 9 zypper in -t patch SUSE-OpenStack-Cloud-Crowbar-9-2023-2959=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 zypper in -t patch SUSE-SLE-SAP-12-SP4-2023-2959=1 * SUSE Linux Enterprise Software Development Kit 12 SP5 zypper in -t patch SUSE-SLE-SDK-12-SP5-2023-2959=1 * SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 zypper in -t patch SUSE-SLE-SERVER-12-SP2-BCL-2023-2959=1 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 zypper in -t patch SUSE-SLE-SERVER-12-SP4-ESPOS-2023-2959=1 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 zypper in -t patch SUSE-SLE-SERVER-12-SP4-LTSS-2023-2959=1 * SUSE Linux Enterprise High Performance Computing 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2959=1 * SUSE Linux Enterprise Server 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2959=1 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 zypper in -t patch SUSE-SLE-SERVER-12-SP5-2023-2959=1 * SUSE OpenStack Cloud 9 zypper in -t patch SUSE-OpenStack-Cloud-9-2023-2959=1 ## Package List: * SUSE OpenStack Cloud Crowbar 9 (x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE OpenStack Cloud Crowbar 9 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 (ppc64le x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server for SAP Applications 12 SP4 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Software Development Kit 12 SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Software Development Kit 12 SP5 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP2 BCL 12-SP2 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (aarch64 x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP4 ESPOS 12-SP4 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP4 LTSS 12-SP4 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise High Performance Computing 12 SP5 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server 12 SP5 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE Linux Enterprise Server for SAP Applications 12 SP5 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 * SUSE OpenStack Cloud 9 (x86_64) * MozillaFirefox-debuginfo-115.0.2-112.170.2 * MozillaFirefox-115.0.2-112.170.2 * MozillaFirefox-translations-common-115.0.2-112.170.2 * MozillaFirefox-debugsource-115.0.2-112.170.2 * SUSE OpenStack Cloud 9 (noarch) * MozillaFirefox-devel-115.0.2-112.170.2 ## References: * https://www.suse.com/security/cve/CVE-2023-3600.html * https://bugzilla.suse.com/show_bug.cgi?id=1213230