🛡️ SUSE-SU-2022:3273-1 — mozillafirefox (CVE-2022-38472 +27 more)

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 102.2.0esr ESR:

• Fixed: Various stability, functionality, and security fixes.
• MFSA 2022-34 (bsc#1202645)
• CVE-2022-38472 (bmo#1769155)

Address bar spoofing via XSLT error handling

• CVE-2022-38473 (bmo#1771685)

Cross-origin XSLT Documents would have inherited the parent's

permissions

• CVE-2022-38476 (bmo#1760998)

Data race and potential use-after-free in PK11_ChangePW

• CVE-2022-38477 (bmo#1760611, bmo#1770219, bmo#1771159,

bmo#1773363)

Memory safety bugs fixed in Firefox 104 and Firefox ESR 102.2

• CVE-2022-38478 (bmo#1770630, bmo#1776658)

Memory safety bugs fixed in Firefox 104, Firefox ESR 102.2,

and Firefox ESR 91.13

Firefox Extended Support Release 102.1 ESR

• Fixed: Various stability, functionality, and security fixes.
• MFSA 2022-30 (bsc#1201758)
• CVE-2022-36319 (bmo#1737722)

Mouse Position spoofing with CSS transforms

• CVE-2022-36318 (bmo#1771774)

Directory indexes for bundled resources reflected URL

parameters

• CVE-2022-36314 (bmo#1773894)

Opening local <code>.lnk</code> files could cause unexpected

network loads

• CVE-2022-2505 (bmo#1769739, bmo#1772824)

Memory safety bugs fixed in Firefox 103 and 102.1

• Firefox Extended Support Release 102.0.1 ESR
• Fixed: Fixed bookmark shortcut creation by dragging to

Windows File Explorer and dropping partially broken

(bmo#1774683)

• Fixed: Fixed bookmarks sidebar flashing white when opened in

dark mode (bmo#1776157)

• Fixed: Fixed multilingual spell checking not working with

content in both English and a non-Latin alphabet

(bmo#1773802)

• Fixed: Developer tools: Fixed an issue where the console

output keep getting scrolled to the bottom when the last

visible message is an evaluation result (bmo#1776262)

• Fixed: Fixed *Delete cookies and site data when Firefox is

closed* checkbox getting disabled on startup (bmo#1777419)

• Fixed: Various stability fixes

Firefox 102.0 ESR:

• New:
• We now provide more secure connections: Firefox can

now automatically upgrade to HTTPS using HTTPS RR as Alt-Svc

headers.

• For added viewing pleasure, full-range color levels are now

supported for video playback on many systems.

• Find it easier now! Mac users can now access the macOS

share options from the Firefox File menu.

• Voilà! Support for images containing ICC v4 profiles is

enabled on macOS.

• Firefox now supports the new AVIF image format, which is

based on the modern and royalty-free AV1 video codec. It

offers significant bandwidth savings for sites compared to

existing image formats. It also supports transparency and

other advanced features.

• Firefox PDF viewer now supports filling more forms (e.g.,

XFA-based forms, used by multiple governments and banks).

Learn more.

• When available system memory is critically low, Firefox on

Windows will automatically unload tabs based on their last

access time, memory usage, and other attributes. This helps

to reduce Firefox out-of-memory crashes. Forgot something?

Switching to an unloaded tab automatically reloads it.

• To prevent session loss for macOS users who are running

Firefox from a mounted .dmg file, they’ll now be prompted to

finish installation. Bear in mind, this permission prompt

only appears the first time these users run Firefox on their

computer.

• For your safety, Firefox now blocks downloads that rely on

insecure connections, protecting against potentially

malicious or unsafe downloads. Learn more and see where to

find downloads in Firefox.

• Improved web compatibility for privacy protections with

SmartBlock 3.0: In Private Browsing and Strict Tracking

Protection, Firefox goes to great lengths to protect your web

browsing activity from trackers. As part of this, the built-

in content blocking will automatically block third-party

scripts, images, and other content from being loaded from

cross-site tracking companies reported by Disconnect. Learn

more.

• Introducing a new referrer tracking protection in Strict

Tracking Protection and Private Browsing. This feature

prevents sites from unknowingly leaking private information

to trackers. Learn more.

• Introducing Firefox Suggest, a feature that provides

website suggestions as you type into the address bar. Learn

more about this faster way to navigate the web and locale-

specific features.

• Firefox macOS now uses Apple's low-power mode for

fullscreen video on sites such as YouTube and Twitch. This

meaningfully extends battery life in long viewing sessions.

Now your kids can find out what the fox says on a loop

without you ever missing a beat…

• With this release, power users can use about:unloads to

release system reso