From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-announce+bounces-3251-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 2D74915808B
for <garchives@archives.gentoo.org>; Mon, 19 Feb 2024 06:14:52 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 158EFE2C39;
Mon, 19 Feb 2024 06:11:20 +0000 (UTC)
Received: from smtp.gentoo.org (woodpecker.gentoo.org [140.211.166.183])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256)
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id 2D2A4E2B28
for <gentoo-announce@lists.gentoo.org>; Mon, 19 Feb 2024 05:59:32 +0000 (UTC)
Received: from glsamakerdev.dev.gentoo.org (unknown [140.211.166.165])
by smtp.gentoo.org (Postfix) with ESMTP id 50145343025
for <gentoo-announce@lists.gentoo.org>; Mon, 19 Feb 2024 05:59:31 +0000 (UTC)
Received: from [172.18.0.3] (unknown [172.18.0.3])
by glsamakerdev.dev.gentoo.org (Postfix) with ESMTP id 37275B39DA
for <gentoo-announce@lists.gentoo.org>; Mon, 19 Feb 2024 05:59:31 +0000 (UTC)
Subject: [gentoo-announce] [ GLSA 202402-26 ] Mozilla Firefox: Multiple Vulnerabilities
Precedence: bulk
List-Post: <mailto:gentoo-announce@lists.gentoo.org>
List-Help: <mailto:gentoo-announce+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-announce+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-announce+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-announce.gentoo.org>
X-BeenThere: gentoo-announce@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
MIME-Version: 1.0
Content-Type: multipart/signed; protocol="application/pgp-signature";
micalg="pgp-sha512"; boundary="===============5329577625298193102=="
From: glsamaker@gentoo.org
To: gentoo-announce@lists.gentoo.org
Reply-To: security@gentoo.org
Date: Mon, 19 Feb 2024 05:59:31 -0000
Message-ID: <170832237122.8.17663778945793278263@987c7955d8b1>
X-Archives-Salt: 78fe1644-ee29-4c72-be0c-591d9984c9c7
X-Archives-Hash: f3199e40505997515d99c1db5ea3c47c
--===============5329577625298193102==
Content-Type: text/plain; charset="utf-8"
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202402-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Mozilla Firefox: Multiple Vulnerabilities
Date: February 19, 2024
Bugs: #924844
ID: 202402-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been discovered in Mozilla Firefox, the
worst of which could result in arbitrary code execution.
Background
==========
Mozilla Firefox is a popular open-source web browser from the Mozilla
project.
Affected packages
=================
Package Vulnerable Unaffected
---------------------- ------------- --------------
www-client/firefox < 115.7.0:esr >= 115.7.0:esr
< 122.0:rapid >= 122.0:rapid
www-client/firefox-bin < 115.7.0:esr >= 115.7.0:esr
< 122.0:rapid >= 122.0:rapid
Description
===========
Multiple vulnerabilities have been discovered in Mozilla Firefox. Please
review the CVE identifiers referenced below for details.
Impact
======
Please review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Mozilla Firefox ESR users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-115.7.0:esr"
All Mozilla Firefox ESR binary users should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-115.7.0:esr"
All Mozilla Firefox users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-122.0:rapid"
All Mozilla Firefox binary users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-client/firefox-bin-122.0:rapid"
References
==========
[ 1 ] CVE-2024-0741
https://nvd.nist.gov/vuln/detail/CVE-2024-0741
[ 2 ] CVE-2024-0742
https://nvd.nist.gov/vuln/detail/CVE-2024-0742
[ 3 ] CVE-2024-0743
https://nvd.nist.gov/vuln/detail/CVE-2024-0743
[ 4 ] CVE-2024-0744
https://nvd.nist.gov/vuln/detail/CVE-2024-0744
[ 5 ] CVE-2024-0745
https://nvd.nist.gov/vuln/detail/CVE-2024-0745
[ 6 ] CVE-2024-0746
https://nvd.nist.gov/vuln/detail/CVE-2024-0746
[ 7 ] CVE-2024-0747
https://nvd.nist.gov/vuln/detail/CVE-2024-0747
[ 8 ] CVE-2024-0748
https://nvd.nist.gov/vuln/detail/CVE-2024-0748
[ 9 ] CVE-2024-0749
https://nvd.nist.gov/vuln/detail/CVE-2024-0749
[ 10 ] CVE-2024-0750
https://nvd.nist.gov/vuln/detail/CVE-2024-0750
[ 11 ] CVE-2024-0751
https://nvd.nist.gov/vuln/detail/CVE-2024-0751
[ 12 ] CVE-2024-0752
https://nvd.nist.gov/vuln/detail/CVE-2024-0752
[ 13 ] CVE-2024-0753
https://nvd.nist.gov/vuln/detail/CVE-2024-0753
[ 14 ] CVE-2024-0754
https://nvd.nist.gov/vuln/detail/CVE-2024-0754
[ 15 ] CVE-2024-0755
https://nvd.nist.gov/vuln/detail/CVE-2024-0755
[ 16 ] MFSA-2024-01
[ 17 ] MFSA-2024-02
[ 18 ] MFSA-2024-04
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/202402-26
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2024 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
--===============5329577625298193102==
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmXS7kMACgkQFMQkOaVy
+9kSmBAAqzmPvTl46EeZWl4XL2L2zjje9Z34Mt/ZVZMTOYSlwqQlUubton6OWRGR
dYRbKBUquh+OqeXvdSYeI6huQF3ltrzvX8FkzHQzyo4SrNeOBmg/qyGNkIX5EkqR
np2ETjBgM/f8J2xGmA3SUVhEgBEXtMirUaqNK0puPoKzi6RtTB57FnWtJKxWfwfS
Nr+J356eb/u2P+3Tzi5xzonHnBU40h1ZoupW6JQR0x3Q6I2PesitzPb7RL8D4FiM
ZmvvkhJR/woAEYIcuyrBc0cCl0e8GclYwE+BEZStEMmCKm8bDQVkxE7/X2NjUNtw
C1a5k4hNCcHGIiYDRA4M3DgfacvC7dT3++zz1/MQAd+qh1OIJAimAl0KJlLdg7L0
yn1nEHVvIKiSzoYcw80LHEwhcw2cF9+q8YDNeZRoffy3tDCVAQRlAjqRNkC5SW6W
zQsDZTbIf4vv0NEcnan2d7RXSNWwH9H7+SIUPnzhnjH6Rk8mqct+i/q/fazY8/Ya
WL3+9no3vAXs2qdN62uMcCMuGNvrnJP5itk0P2HQHYsso/ycx5LnpVT53dZusRdz
PFRauq5r6+xjnOhYzRpVsLwsLhR3yDW+JcxdkQvH5hBa6fHcjzUEvSjQx7qHp2gi
ADyvyvZnDuLxmjvXwGTJwJUw06b7Pz97dW8oC38ThvSR5XYn6e0=
=HPL2
-----END PGP SIGNATURE-----
--===============5329577625298193102==--