Security update for MozillaFirefox (important)

An update that fixes 34 vulnerabilities is now available.

Description:

This update for MozillaFirefox fixes the following issues:

Mozilla Firefox was updated to 102.3.0esr ESR (bsc#1200793, bsc#1201758,
bsc#1202645, bsc#1203477):

• CVE-2022-40959: Fixed bypassing FeaturePolicy restrictions on transient
  pages.
• CVE-2022-40960: Fixed data-race when parsing non-UTF-8 URLs in threads.
• CVE-2022-40958: Fixed bypassing secure context restriction for cookies
  with __Host and __Secure prefix.
• CVE-2022-40956: Fixed content-security-policy base-uri bypass.
• CVE-2022-40957: Fixed incoherent instruction cache when building WASM on
  ARM64.
• CVE-2022-40962: Fixed memory safety bugs.
• CVE-2022-38472: Fixed a potential address bar spoofing via XSLT error
  handling.
• CVE-2022-38473: Fixed an issue where cross-origin XSLT documents could
  inherit the parent’s permissions.
• CVE-2022-38478: Fixed various memory safety issues.
• CVE-2022-38476: Fixed data race and potential use-after-free in
  PK11_ChangePW.
• CVE-2022-38477: Fixed memory safety bugs.
• CVE-2022-36319: Fixed mouse position spoofing with CSS transforms.
• CVE-2022-36318: Fixed directory indexes for bundled resources reflected
  URL parameters.
• CVE-2022-36314: Fixed unexpected network loads when opening local .lnk
  files.
• CVE-2022-2505: Fixed memory safety bugs.
• CVE-2022-34479: Fixed vulnerabilty where a popup window could be resized
  in a way to overlay the address bar with web content.
• CVE-2022-34470: Fixed use-after-free in nsSHistory.
• CVE-2022-34468: Fixed bypass of CSP sandbox header without
  allow-scripts via retargeted javascript: URI.
• CVE-2022-34482: Fixed drag and drop of malicious image that could have
  led to malicious executable and potential code execution.
• CVE-2022-34483: Fixed drag and drop of malicious image that could have
  led to malicious executable and potential code execution.
• CVE-2022-34476: Fixed vulnerability where ASN.1 parser could have been
  tricked into accepting malformed ASN.1.
• CVE-2022-34481: Fixed potential integer overflow in ReplaceElementsAt
• CVE-2022-34474: Fixed vulnerability where sandboxed iframes could
  redirect to external schemes.
• CVE-2022-34469: Fixed TLS certificate errors on HSTS-protected domains
  which could be bypassed by the user on Firefox for Android.
• CVE-2022-34471: Fixed vulnerability where a compromised server could
  trick a browser into an addon downgrade.
• CVE-2022-34472: Fixed vulnerability where an unavailable PAC file
  resulted in OCSP requests being blocked.
• CVE-2022-34478: Fixed vulnerability where Microsoft protocols can be
  attacked if a user accepts a prompt.
• CVE-2022-2200: Fixed vulnerability where undesired attributes could be
  set as part of prototype pollution.
• CVE-2022-34480: Fixed free of uninitialized pointer in lg_init.
• CVE-2022-34477: Fixed vulnerability in MediaError message property
  leaking information on cross-origin same-site pages.
• CVE-2022-34475: Fixed vulnerability where the HTML Sanitizer could have
  been bypassed via same-origin script via use tags.
• CVE-2022-34473: Fixed vulnerability where the HTML Sanitizer could have
  been bypassed via use tags.
• CVE-2022-34484: Fixed memory safety bugs.
• CVE-2022-34485: Fixed memory safety bugs.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.4:

  zypper in -t patch openSUSE-SLE-15.4-2022-3396=1

• openSUSE Leap 15.3:

  zypper in -t patch openSUSE-SLE-15.3-2022-3396=1

• SUSE Manager Server 4.1:

  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.1-2022-3396=1

• SUSE Manager Retail Branch Server 4.1:

  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.1-2022-3396=1

• SUSE Manager Proxy 4.1:

  zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.1-2022-3396=1

• SUSE Linux Enterprise Server for SAP 15-SP2:

  zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP2-2022-3396=1

• SUSE Linux Enterprise Server 15-SP2-LTSS:

  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2022-3396=1

• SUSE Linux Enterprise Server 15-SP2-BCL:

  zypper in -t patch SUSE-SLE-Product-SLES-15-SP2-BCL-2022-3396=1

• SUSE Linux Enterprise Module for Desktop Applications 15-SP4:

  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP4-2022-3396=1

• SUSE Linux Enterprise Module for Desktop Applications 15-SP3:

  zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP3-2022-3396=1

• SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS:

  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2022-3396=1

• SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS:

  zypper in -t patch SUSE-SLE-Product-HPC-15-SP2-ESPOS-2022-3396=1

• SUSE Enterprise Storage 7:

  zypper in -t patch SUSE-Storage-7-2022-3396=1