- Update to version 102.11.0:
+ Various security fixes.
+ CVE-2023-32205: Browser prompts could have been obscured by
popups
+ CVE-2023-32206: Crash in RLBox Expat driver
+ CVE-2023-32207: Potential permissions request bypass via
clickjacking
+ CVE-2023-32211: Content process crash due to invalid wasm code
+ CVE-2023-32212: Potential spoof due to obscured address bar
+ CVE-2023-32213: Potential memory corruption in
FileReader::DoReadData()
+ CVE-2023-32214: Potential DoS via exposed protocol handlers
+ CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and
Firefox ESR 102.11
OBS-URL: https://build.opensuse.org/request/show/1085761
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/mozjs102?expand=0&rev=23
- Update to version 102.7.0:
+ Various stability, functionality, and security fixes.
+ CVE-2022-46871: libusrsctp library out of date.
+ CVE-2023-23598: Arbitrary file read from GTK drag and drop on
Linux.
+ CVE-2023-23599: Malicious command could be hidden in devtools
output on Windows.
+ CVE-2023-23601: URL being dragged from cross-origin iframe into
same tab triggers navigation.
+ CVE-2023-23602: Content Security Policy wasn't being correctly
applied to WebSockets in WebWorkers.
+ CVE-2022-46877: Fullscreen notification bypass.
+ CVE-2023-23603: Calls to <code>console.log</code> allowed
bypasing Content Security Policy via format directive.
+ CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and
Firefox ESR 102.7.
OBS-URL: https://build.opensuse.org/request/show/1058990
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/mozjs102?expand=0&rev=13