Most recent entries from all

ALSA-2026:3338 — Important: firefox security update

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026…

bdu:2026-02014

certfr-2026-avi-0175 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0175

EUVD-2026-337787

fkie_cve-2026-2447

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

GHSA-c99q-x737-hc5j

Heap buffer overflow in libvpx. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, and Firefox ESR < 115.32.1.

OESA-2026-1451 — libvpx security update

Affected: openEuler:24.03-LTS-SP1: libvpx, openEuler:24.03-LTS-SP2: libvpx, openEuler:24.03-LTS-SP3: libvpx, openEuler:20.03-LTS-SP4: libvpx, openEuler:22.03-LTS-SP4: libvpx, openEuler:24.03-LTS: libvpx

libvpx provides the VP8/VP9 SDK, which allows you to integrate your applications with the VP8 and VP9 video codecs, high quality, royalty free, open source codecs deployed on millions of computers and devices worldwide. Security Fix(es):

Heap buffer overflow vulnerability exists in libvpx component. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, and Firefox ESR < 115.32.1.(CVE-2026-2447)

openSUSE-SU-2026:10212-1 — firefox-esr-140.7.1-1.1 on GA media

firefox-esr-140.7.1-1.1 on GA media

RHSA-2026:16174 — Red Hat Security Advisory: Red Hat AI Inference Server 3.3.3 (Spyre)

libxslt: Processing web content may disclose sensitive information libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service cpython: Excessive read buffering DoS in http.client gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification cpython: IMAP command injection in user-controlled commands cpython: POP3 command injection in user-controlled commands python: protobuf: Protobuf: Denial of Service due to recursion depth bypass cpython: email header injection due to unquoted newlines libvpx: Heap buffer overflow in libvpx openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing python: Python: Command-line option injection in webbrowser.open() via crafted URLs libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API giflib: Giflib: Double-free vulnerability leading to memory corruption…

SUSE-SU-2026:0602-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2026-2447

Affected: Ubuntu:Pro:14.04:LTS: libvpx, Ubuntu:Pro:16.04:LTS: libvpx, Ubuntu:Pro:18.04:LTS: libvpx, Ubuntu:20.04:LTS: libvpx, Ubuntu:22.04:LTS: libvpx, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: libvpx, Ubuntu:25.10: libvpx, Ubuntu:26.04:LTS: libvpx

Heap buffer overflow in libvpx. This vulnerability was fixed in Firefox 147.0.4, Firefox ESR 140.7.1, Firefox ESR 115.32.1, Thunderbird 140.7.2, and Thunderbird 147.0.2.

WID-SEC-W-2026-0427 — Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um falsche Informationen darzustellen oder nicht näher spezifizierte Auswirkungen zu verursachen