This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3694580414368483541==
Content-Language: en-US
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="------------tvVuNMU3WLvLoZmQvQv39EMV"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--------------tvVuNMU3WLvLoZmQvQv39EMV
Content-Type: multipart/mixed;
 boundary="------------0INOv0gCHq9Kng7kIQnIxfRJ";
 protected-headers="v1"
From: Chris Coulson <chris.coulson@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Message-ID: <35c5358e-b395-2121-d43e-ad4770bbac24@canonical.com>
Subject: [USN-5321-3] Firefox regressions

--------------0INOv0gCHq9Kng7kIQnIxfRJ
Content-Type: text/plain; charset=UTF-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-5321-3
March 24, 2022

firefox regressions
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 21.10
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS

Summary:

USN-5321-1 introduced minor regressions in Firefox.

Software Description:
- firefox: Mozilla Open Source web browser

Details:

USN-5321-1 fixed vulnerabilities in Firefox. The update introduced
several minor regressions. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

 Multiple security issues were discovered in Firefox. If a user were
 tricked into opening a specially crafted website, an attacker could
 potentially exploit these to cause a denial of service, spoof the browser
 UI, bypass security restrictions, obtain sensitive information, or execute
 arbitrary code. (CVE-2022-0843, CVE-2022-26381, CVE-2022-26382,
 CVE-2022-26383, CVE-2022-26384, CVE-2022-26385)
 
 A TOCTOU bug was discovered when verifying addon signatures during
 install. A local attacker could potentially exploit this to trick a
 user into installing an addon with an invalid signature.
 (CVE-2022-26387)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
  firefox                         98.0.2+build1-0ubuntu0.21.10.1

Ubuntu 20.04 LTS:
  firefox                         98.0.2+build1-0ubuntu0.20.04.1

Ubuntu 18.04 LTS:
  firefox                         98.0.2+build1-0ubuntu0.18.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-5321-3
  https://ubuntu.com/security/notices/USN-5321-1
  https://launchpad.net/bugs/1966306

Package Information:
  https://launchpad.net/ubuntu/+source/firefox/98.0.2+build1-0ubuntu0.21.10.1
  https://launchpad.net/ubuntu/+source/firefox/98.0.2+build1-0ubuntu0.20.04.1
  https://launchpad.net/ubuntu/+source/firefox/98.0.2+build1-0ubuntu0.18.04.1

--------------0INOv0gCHq9Kng7kIQnIxfRJ--

--------------tvVuNMU3WLvLoZmQvQv39EMV
Content-Type: application/pgp-signature; name="OpenPGP_signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="OpenPGP_signature"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEERN//5MGgCOgyKeIFYR+97NWUbg8FAmI8l+QACgkQYR+97NWU
bg/hJAf/fq5IKGLWlbMaGZ9zpMmPj0Qy+KRN52rogGtmnMFSeKquN6Zr9b9ok+yA
2tGxnoc4d+QwEJ4wR6OWjV8Yk8TrW3Gtp++rPWpapv4XPtPIDy6ViWLTaAmEW4Wz
84fo0uj50GLrtVqyVMxXrBmrcTCV3izPEqxCKoyvMk4v+Bvsz/0W6RuaVXFa4urf
xH9Cx0BTN4OI9hNiUWAsvOiNYFYabqTNdXkxASMMZ6ybKsLszHNQ6d/CLK3JbZpD
h8q/A6b+FvKYrW1RJSRWgNtxJFOTLMsmbLtwyCHdlVd9IW32EqnBIyzwRSoV2PI1
+e8EZ5rA1pEefg3LMQ2Krxchxv92Jw==
=302l
-----END PGP SIGNATURE-----

--------------tvVuNMU3WLvLoZmQvQv39EMV--


--===============3694580414368483541==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

Cg==

--===============3694580414368483541==--