Oval Definition:oval:org.opensuse.security:def:55248
Revision Date:2021-09-22Version:1
Title:Security update for MozillaFirefox (Important)
Description:
This update for MozillaFirefox fixes the following issues:

This update contains the Firefox Extended Support Release 91.1.0 ESR.

* Fixed: Various stability, functionality, and security fixes

MFSA 2021-40 (bsc#1190269, bsc#1190274):

* CVE-2021-38492: Navigating to `mk:` URL scheme could load Internet Explorer
* CVE-2021-38495: Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1

Firefox 91.0.1esr ESR

* Fixed: Fixed an issue causing buttons on the tab bar to be
resized when loading certain websites (bug 1704404)
* Fixed: Fixed an issue which caused tabs from private windows
to be visible in non-private windows when viewing switch-to-
tab results in the address bar panel (bug 1720369)
* Fixed: Various stability fixes
* Fixed: Security fix MFSA 2021-37 (bsc#1189547)
* CVE-2021-29991 (bmo#1724896)
Header Splitting possible with HTTP/3 Responses

Firefox Extended Support Release 91.0 ESR

* New: Some of the highlights of the new Extended Support Release are:

- A number of user interface changes. For more information,
see the Firefox 89 release notes.
- Firefox now supports logging into Microsoft, work, and
school accounts using Windows single sign-on. Learn more
- On Windows, updates can now be applied in the background
while Firefox is not running.
- Firefox for Windows now offers a new page about:third-party
to help identify compatibility issues caused by third-party
applications
- Version 2 of Firefox's SmartBlock feature further improves
private browsing. Third party Facebook scripts are blocked to
prevent you from being tracked, but are now automatically
loaded 'just in time' if you decide to 'Log in with Facebook'
on any website.
- Enhanced the privacy of the Firefox Browser's Private
Browsing mode with Total Cookie Protection, which confines
cookies to the site where they were created, preventing
companis from using cookies to track your browsing across
sites. This feature was originally launched in Firefox's ETP
Strict mode.
- PDF forms now support JavaScript embedded in PDF files.
Some PDF forms use JavaScript for validation and other
interactive features.
- You'll encounter less website breakage in Private Browsing
and Strict Enhanced Tracking Protection with SmartBlock,
which provides stand-in scripts so that websites load
properly.
- Improved Print functionality with a cleaner design and
better integration with your computer's printer settings.
- Firefox now protects you from supercookies, a type of
tracker that can stay hidden in your browser and track you
online, even after you clear cookies. By isolating
supercookies, Firefox prevents them from tracking your web
browsing from one site to the next.
- Firefox now remembers your preferred location for saved
bookmarks, displays the bookmarks toolbar by default on new
tabs, and gives you easy access to all of your bookmarks via
a toolbar folder.
- Native support for macOS devices built with Apple Silicon
CPUs brings dramatic performance improvements over the non-
native build that was shipped in Firefox 83: Firefox launches
over 2.5 times faster and web apps are now twice as
responsive (per the SpeedoMeter 2.0 test). If you are on a
new Apple device, follow these steps to upgrade to the latest
Firefox.
- Pinch zooming will now be supported for our users with
Windows touchscreen devices and touchpads on Mac devices.
Firefox users may now use pinch to zoom on touch-capable
devices to zoom in and out of webpages.
- We’ve improved functionality and design for a number of
Firefox search features:
* Selecting a search engine at the bottom of the search
panel now enters search mode for that engine, allowing you to
see suggestions (if available) for your search terms. The old
behavior (immediately performing a search) is available with
a shift-click.
* When Firefox autocompletes the URL of one of your search
engines, you can now search with that engine directly in the
address bar by selecting the shortcut in the address bar
results.
* We’ve added buttons at the bottom of the search panel to
allow you to search your bookmarks, open tabs, and history.
- Firefox supports AcroForm, which will allow you to fill in,
print, and save supported PDF forms and the PDF viewer also
has a new fresh look.
- For our users in the US and Canada, Firefox can now save,
manage, and auto-fill credit card information for you, making
shopping on Firefox ever more convenient.
- In addition to our default, dark and light themes, with
this release, Firefox introduces the Alpenglow theme: a
colorful appearance for buttons, menus, and windows. You can
update your Firefox themes under settings or preferences.
* Changed: Firefox no longer supports Adobe Flash. There is no
setting available to re-enable Flash support.
* Enterprise: Various bug fixes and new policies have been
implemented in the latest version of Firefox. See more
details in the Firefox for Enterprise 91 Release Notes.

MFSA 2021-33 (bsc#1188891):

* CVE-2021-29986: Race condition when resolving DNS names could have led to
memory corruption
* CVE-2021-29981: Live range splitting could have led to conflicting
assignments in the JIT
* CVE-2021-29988: Memory corruption as a result of incorrect style treatment
* CVE-2021-29983: Firefox for Android could get stuck in fullscreen mode
* CVE-2021-29984: Incorrect instruction reordering during JIT optimization
* CVE-2021-29980: Uninitialized memory in a canvas object could have led to
memory corruption
* CVE-2021-29987: Users could have been tricked into accepting unwanted
permissions on Linux
* CVE-2021-29985: Use-after-free media channels
* CVE-2021-29982: Single bit data leak due to incorrect JIT optimization and
type confusion
* CVE-2021-29989: Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
* CVE-2021-29990: Memory safety bugs fixed in Firefox 91
Family:unixClass:patch
Status:Reference(s):1054979
1081959
1081961
1081962
1096974
1096984
1099498
1105434
1109105
1111479
1111480
1112229
1115245
1117022
1117274
1117313
1117327
1117331
1117751
1117776
1118460
1118462
1118463
1125623
1125666
1126117
1126118
1126119
1138872
1188891
1189547
1190269
1190274
387731
853846
928193
942690
951734
951735
956018
956021
956260
957105
957106
957107
957109
957110
958861
960341
967190
968787
969727
970072
970073
973010
973164
975930
980483
980854
CVE-2004-2779
CVE-2008-2109
CVE-2008-4989
CVE-2011-4128
CVE-2012-0390
CVE-2012-1569
CVE-2012-1573
CVE-2013-6424
CVE-2014-0092
CVE-2014-0105
CVE-2014-1959
CVE-2014-3466
CVE-2014-7144
CVE-2014-7202
CVE-2014-7203
CVE-2014-8564
CVE-2014-9721
CVE-2015-0294
CVE-2015-1819
CVE-2015-1852
CVE-2015-3622
CVE-2015-5312
CVE-2015-6251
CVE-2015-7497
CVE-2015-7498
CVE-2015-7499
CVE-2015-7500
CVE-2015-7554
CVE-2015-7941
CVE-2015-7942
CVE-2015-8000
CVE-2015-8241
CVE-2015-8242
CVE-2015-8317
CVE-2016-1234
CVE-2016-1285
CVE-2016-1286
CVE-2016-3075
CVE-2016-3706
CVE-2016-4429
CVE-2016-6354
CVE-2017-11550
CVE-2017-11551
CVE-2017-2581
CVE-2017-2586
CVE-2017-2587
CVE-2018-1000222
CVE-2018-10360
CVE-2018-17183
CVE-2018-17961
CVE-2018-18073
CVE-2018-18284
CVE-2018-19409
CVE-2018-19475
CVE-2018-19476
CVE-2018-19477
CVE-2018-19636
CVE-2018-19637
CVE-2018-19638
CVE-2018-19639
CVE-2018-19640
CVE-2019-11708
CVE-2019-8905
CVE-2019-8906
CVE-2019-8907
CVE-2021-29980
CVE-2021-29981
CVE-2021-29982
CVE-2021-29983
CVE-2021-29984
CVE-2021-29985
CVE-2021-29986
CVE-2021-29987
CVE-2021-29988
CVE-2021-29989
CVE-2021-29990
CVE-2021-29991
CVE-2021-38492
CVE-2021-38495
SUSE-SU-2015:2359-1
SUSE-SU-2016:0030-1
SUSE-SU-2016:0160-1
SUSE-SU-2016:0825-1
SUSE-SU-2016:1733-1
SUSE-SU-2018:0722-1
SUSE-SU-2018:2837-1
SUSE-SU-2018:4090-1
SUSE-SU-2019:0839-1
SUSE-SU-2019:1122-1
SUSE-SU-2019:1684-1
SUSE-SU-2021:3191-1
Platform(s):openSUSE Leap 15.0
openSUSE Leap 15.1
SUSE Linux Enterprise Desktop 11 SP2
SUSE Linux Enterprise Desktop 11 SP3
SUSE Linux Enterprise Desktop 11 SP4
SUSE Linux Enterprise Desktop 12 SP3
SUSE Linux Enterprise Desktop 12 SP4
SUSE Linux Enterprise Server 12 SP1
SUSE Linux Enterprise Server 12 SP1-LTSS
SUSE Linux Enterprise Server 12 SP2
SUSE Linux Enterprise Server 12 SP2-BCL
SUSE Linux Enterprise Server 12 SP2-ESPOS
SUSE Linux Enterprise Server 12 SP2-LTSS
SUSE Linux Enterprise Server 12 SP3
SUSE Linux Enterprise Server 12 SP3-BCL
SUSE Linux Enterprise Server 12 SP3-ESPOS
SUSE Linux Enterprise Server 12 SP3-LTSS
SUSE Linux Enterprise Server 12 SP3-TERADATA
SUSE Linux Enterprise Server 12 SP4
SUSE OpenStack Cloud 6
SUSE OpenStack Cloud 7
Product(s):
Definition Synopsis
  • openSUSE Leap 15.0 is installed
  • AND autofs-5.1.3-lp150.5 is installed
    • Definition Synopsis
  • openSUSE Leap 15.1 is installed
  • AND Package Information
  • GraphicsMagick-1.3.29-lp151.4.6 is installed
  • OR GraphicsMagick-devel-1.3.29-lp151.4.6 is installed
  • OR libGraphicsMagick++-Q16-12-1.3.29-lp151.4.6 is installed
  • OR libGraphicsMagick++-devel-1.3.29-lp151.4.6 is installed
  • OR libGraphicsMagick-Q16-3-1.3.29-lp151.4.6 is installed
  • OR libGraphicsMagick3-config-1.3.29-lp151.4.6 is installed
  • OR libGraphicsMagickWand-Q16-2-1.3.29-lp151.4.6 is installed
  • OR perl-GraphicsMagick-1.3.29-lp151.4.6 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP2 is installed
  • AND Package Information
  • xorg-x11-Xvnc-7.4-27.70.76 is installed
  • OR xorg-x11-server-7.4-27.70.76 is installed
  • OR xorg-x11-server-extra-7.4-27.70.76 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP3 is installed
  • AND Package Information
  • libxml2-2.7.6-0.34 is installed
  • OR libxml2-32bit-2.7.6-0.34 is installed
  • OR libxml2-python-2.7.6-0.34 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 11 SP4 is installed
  • AND Package Information
  • bind-9.9.6P1-0.25 is installed
  • OR bind-libs-9.9.6P1-0.25 is installed
  • OR bind-libs-32bit-9.9.6P1-0.25 is installed
  • OR bind-utils-9.9.6P1-0.25 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP3 is installed
  • AND Package Information
  • gd-2.1.0-24.9 is installed
  • OR gd-32bit-2.1.0-24.9 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Desktop 12 SP4 is installed
  • AND Package Information
  • libnetpbm11-10.66.3-7 is installed
  • OR libnetpbm11-32bit-10.66.3-7 is installed
  • OR netpbm-10.66.3-7 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1 is installed
  • AND Package Information
  • gnutls-3.2.15-11 is installed
  • OR libgnutls-openssl27-3.2.15-11 is installed
  • OR libgnutls28-3.2.15-11 is installed
  • OR libgnutls28-32bit-3.2.15-11 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP1-LTSS is installed
  • AND Package Information
  • evince-3.10.3-2.3 is installed
  • OR evince-lang-3.10.3-2.3 is installed
  • OR libevdocument3-4-3.10.3-2.3 is installed
  • OR libevview3-3-3.10.3-2.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2 is installed
  • AND ant-1.9.4-1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-BCL is installed
  • AND Package Information
  • MozillaFirefox-91.1.0-112.71.1 is installed
  • OR MozillaFirefox-branding-SLE-91-35.6.6 is installed
  • OR MozillaFirefox-devel-91.1.0-112.71.1 is installed
  • OR MozillaFirefox-translations-common-91.1.0-112.71.1 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-ESPOS is installed
  • AND Package Information
  • ghostscript-9.27-23.31 is installed
  • OR ghostscript-x11-9.27-23.31 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP2-LTSS is installed
  • AND Package Information
  • libopenssl-devel-1.0.2j-60.30 is installed
  • OR libopenssl1_0_0-1.0.2j-60.30 is installed
  • OR libopenssl1_0_0-32bit-1.0.2j-60.30 is installed
  • OR libopenssl1_0_0-hmac-1.0.2j-60.30 is installed
  • OR libopenssl1_0_0-hmac-32bit-1.0.2j-60.30 is installed
  • OR openssl-1.0.2j-60.30 is installed
  • OR openssl-doc-1.0.2j-60.30 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3 is installed
  • AND Package Information
  • emacs-24.3-19 is installed
  • OR emacs-el-24.3-19 is installed
  • OR emacs-info-24.3-19 is installed
  • OR emacs-nox-24.3-19 is installed
  • OR emacs-x11-24.3-19 is installed
  • OR etags-24.3-19 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-BCL is installed
  • AND clamav-0.100.3-33.29 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-ESPOS is installed
  • AND Package Information
  • kernel-default-4.4.180-94.103 is installed
  • OR kernel-default-base-4.4.180-94.103 is installed
  • OR kernel-default-devel-4.4.180-94.103 is installed
  • OR kernel-devel-4.4.180-94.103 is installed
  • OR kernel-macros-4.4.180-94.103 is installed
  • OR kernel-source-4.4.180-94.103 is installed
  • OR kernel-syms-4.4.180-94.103 is installed
  • OR kgraft-patch-4_4_180-94_103-default-1-4.3 is installed
  • OR kgraft-patch-SLE12-SP3_Update_28-1-4.3 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-LTSS is installed
  • AND Package Information
  • kgraft-patch-4_4_156-94_64-default-6-2 is installed
  • OR kgraft-patch-SLE12-SP3_Update_20-6-2 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP3-TERADATA is installed
  • AND Package Information
  • java-1_8_0-openjdk-1.8.0.222-27.35 is installed
  • OR java-1_8_0-openjdk-demo-1.8.0.222-27.35 is installed
  • OR java-1_8_0-openjdk-devel-1.8.0.222-27.35 is installed
  • OR java-1_8_0-openjdk-headless-1.8.0.222-27.35 is installed
    • Definition Synopsis
  • SUSE Linux Enterprise Server 12 SP4 is installed
  • AND Package Information
  • cracklib-2.9.0-7 is installed
  • OR libcrack2-2.9.0-7 is installed
  • OR libcrack2-32bit-2.9.0-7 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 6 is installed
  • AND Package Information
  • python-keystoneclient-1.7.2-3 is installed
  • OR python-keystoneclient-doc-1.7.2-3 is installed
    • Definition Synopsis
  • SUSE OpenStack Cloud 7 is installed
  • AND nodejs6-6.14.3-11.15 is installed
    • BACK