[USN-6992-1] Firefox vulnerabilities

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEAPYWTpwtIbr7xH4OWNrRIKaTkWcFAmbZHiMFAwAAAAAACgkQWNrRIKaTkWfy
sxAAs26/bTI97cDeBXWl9KM3htIGMfY/U+JLRes2zpB/P599uuJdxbPyw/gg/jbnk43Yd+muc6P9
CF1Rcc/tLKG5rZT1MIihwVJxIM3F8i20NGmJg7g1KhGkdQKbjM5EHFDHStRP0XqDuGiY06jCdDyv
uUycOoJK7tYSjWDJszOK5g6NiyyQa99U7UXFf4Z0FP4etLCRvNYRK+yoLYgsTn07Ie08qA9LBdiw
nEjI2lApZZ/DcRIl6pLBItcxdwD9Qyo2gU0GoeqjIqf8ZLX7rPpOkVwsiaK/9vxttfNeQ0WKqw+g
flQ6LKYN0+OrCzDjEBm/FRQKXgxxV8k7bQHthi3hQHp18aYEE6ySSMqWzi+ak4j4fkPUmUS6s5MQ
2Yb9Hn0UOurB5XlFzHw/dT10xH+4eDu0tMiIRQbPWnP153JbVD2HXaHL/hMTW6x7+RL4zx7rteCW
5bdNG/DYlcDI3PsqK/JNf8DRGCAVSlW97xLsR13YwMNvHDs3eo8kxn9VcCIJqjZKoq+ZbeyzAKA8
mQRXgdnmNi++K8Jqy6hxF8g84KV19zoiaUJhI0NBu8QRjzEq18Y5V7HLFPiHDiYlWzVuken98HrX
YpbPFWhj5NK5xEKFl3DnLRiBRQdZFCJYkO1hII5uRvM5xnpIS7PO3AZEakYJpIAdB47eAe5KQXlw
gwM=
=xYKO
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6992-1
September 05, 2024

firefox vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

Multiple security issues were discovered in Firefox. If a user were
tricked into opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, obtain sensitive
information across domains, or execute arbitrary code. (CVE-2024-8382,
CVE-2024-8383, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389)

Nils Bars discovered that Firefox contained a type confusion vulnerability
when performing certain property name lookups. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8381)

It was discovered that Firefox did not properly manage memory during
garbage collection. An attacker could potentially exploit this issue to
cause a denial of service, or execute arbitrary code. (CVE-2024-8384)

Seunghyun Lee discovered that Firefox contained a type confusion
vulnerability when handling certain ArrayTypes. An attacker could
potentially exploit this issue to cause a denial of service, or execute
arbitrary code. (CVE-2024-8385)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 20.04 LTS
firefox 130.0+build2-0ubuntu0.20.04.1

After a standard system update you need to restart Firefox to make all the
necessary changes

References:
https://ubuntu.com/security/notices/USN-6992-1
CVE-2024-8381, CVE-2024-8382, CVE-2024-8383, CVE-2024-8384,
CVE-2024-8385, CVE-2024-8386, CVE-2024-8387, CVE-2024-8389

Package Information:
https://launchpad.net/ubuntu/+source/firefox/130.0+build2-0ubuntu0.20.04.1