MGASA-2023-0111

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2023-0111.html
Import Source
https://advisories.mageia.org/MGASA-2023-0111.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2023-0111
Related
Published
2023-03-24T05:55:49Z
Modified
2023-03-24T04:43:10Z
Summary
Updated firefox packages fix security vulnerability
Details

Sometimes, when invalidating JIT code while following an iterator, the newly generated code could be overwritten incorrectly. This could lead to a potentially exploitable crash (CVE-2023-25751).

When accessing throttled streams, the count of available bytes needed to be checked in the calling function to be within bounds. This may have lead future code to be incorrect and vulnerable (CVE-2023-25752).

While implementing on AudioWorklets, some code may have casted one type to another, invalid, dynamic type. This could have lead to a potentially exploitable crash (CVE-2023-28162).

Dragging a URL from a cross-origin iframe that was removed during the drag could have lead to user confusion and website spoofing attacks (CVE-2023-28164).

Mozilla developers Timothy Nikkel, Andrew McCreight, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox ESR 102.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code (CVE-2023-28176).

References
Credits

Affected packages

Mageia:8 / firefox

Package

Name
firefox
Purl
pkg:rpm/mageia/firefox?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
102.9.0-1.mga8

Ecosystem specific 

{
    "section": "core"
}

Mageia:8 / firefox-l10n

Package

Name
firefox-l10n
Purl
pkg:rpm/mageia/firefox-l10n?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
102.9.0-1.mga8

Ecosystem specific 

{
    "section": "core"
}

Mageia:8 / nss

Package

Name
nss
Purl
pkg:rpm/mageia/nss?distro=mageia-8

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.89.0-1.mga8

Ecosystem specific 

{
    "section": "core"
}