- Update to version 102.14.0:
+ Various security fixes and other quality improvements.
+ CVE-2023-4045: Offscreen Canvas could have bypassed
cross-origin restrictions.
+ CVE-2023-4046: Incorrect value used during WASM compilation.
+ CVE-2023-4047: Potential permissions request bypass via
clickjacking.
+ CVE-2023-4048: Crash in DOMParser due to out-of-memory
conditions.
+ CVE-2023-4049: Fix potential race conditions when releasing
platform objects.
+ CVE-2023-4050: Stack buffer overflow in StorageManager.
+ CVE-2023-4054: Lack of warning when opening appref-ms files.
+ CVE-2023-4055: Cookie jar overflow caused unexpected cookie jar
state.
+ CVE-2023-4056: Memory safety bugs fixed in Firefox 116, Firefox
ESR 115.1, Firefox ESR 102.14, Thunderbird 115.1, and
Thunderbird 102.14.
- Changes from version 102.13.0:
+ Various security fixes and other quality improvements.
+ CVE-2023-37201: Use-after-free in WebRTC certificate generation
+ CVE-2023-37202: Potential use-after-free from compartment
mismatch in SpiderMonkey
+ CVE-2023-37207: Fullscreen notification obscured
+ CVE-2023-37208: Lack of warning when opening Diagcab files
+ CVE-2023-37211: Memory safety bugs fixed in Firefox 115,
Firefox ESR 102.13, and Thunderbird 102.13
OBS-URL: https://build.opensuse.org/request/show/1103476
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/mozjs102?expand=0&rev=27
- Update to version 102.11.0:
+ Various security fixes.
+ CVE-2023-32205: Browser prompts could have been obscured by
popups
+ CVE-2023-32206: Crash in RLBox Expat driver
+ CVE-2023-32207: Potential permissions request bypass via
clickjacking
+ CVE-2023-32211: Content process crash due to invalid wasm code
+ CVE-2023-32212: Potential spoof due to obscured address bar
+ CVE-2023-32213: Potential memory corruption in
FileReader::DoReadData()
+ CVE-2023-32214: Potential DoS via exposed protocol handlers
+ CVE-2023-32215: Memory safety bugs fixed in Firefox 113 and
Firefox ESR 102.11
OBS-URL: https://build.opensuse.org/request/show/1085761
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/mozjs102?expand=0&rev=23
- Update to version 102.7.0:
+ Various stability, functionality, and security fixes.
+ CVE-2022-46871: libusrsctp library out of date.
+ CVE-2023-23598: Arbitrary file read from GTK drag and drop on
Linux.
+ CVE-2023-23599: Malicious command could be hidden in devtools
output on Windows.
+ CVE-2023-23601: URL being dragged from cross-origin iframe into
same tab triggers navigation.
+ CVE-2023-23602: Content Security Policy wasn't being correctly
applied to WebSockets in WebWorkers.
+ CVE-2022-46877: Fullscreen notification bypass.
+ CVE-2023-23603: Calls to <code>console.log</code> allowed
bypasing Content Security Policy via format directive.
+ CVE-2023-23605: Memory safety bugs fixed in Firefox 109 and
Firefox ESR 102.7.
OBS-URL: https://build.opensuse.org/request/show/1058990
OBS-URL: https://build.opensuse.org/package/show/GNOME:Factory/mozjs102?expand=0&rev=13