Security update for MozillaFirefox (important)

An update that fixes 9 vulnerabilities is now available.

Description:

This update for MozillaFirefox fixes the following issues:

Update to Extended Support Release 91.4.0 (bsc#1193485):

• CVE-2021-43536: URL leakage when navigating while executing asynchronous
  function
• CVE-2021-43537: Heap buffer overflow when using structured clone
• CVE-2021-43538: Missing fullscreen and pointer lock notification when
  requesting both
• CVE-2021-43539: GC rooting failure when calling wasm instance methods
• CVE-2021-43541: External protocol handler parameters were unescaped
• CVE-2021-43542: XMLHttpRequest error codes could have leaked the
  existence of an external protocol handler
• CVE-2021-43543: Bypass of CSP sandbox directive when embedding
• CVE-2021-43545: Denial of Service when using the Location API in a loop
• CVE-2021-43546: Cursor spoofing could overlay user interface when native
  cursor is zoomed
• Memory safety bugs fixed in Firefox 95 and Firefox ESR 91.4
• Removed x-scheme-handler/ftp from MozillaFirefox.desktop (bsc#1193321)

This update was imported from the SUSE:SLE-15-SP2:Update update project.

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

• openSUSE Leap 15.2:

  zypper in -t patch openSUSE-2021-1575=1