Most recent entries from all

ALSA-2026:3338 — Important: firefox security update

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026…

bdu:2026-07228

certfr-2026-avi-0204 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2026-avi-0204

cnvd-2026-13440

EUVD-2026-373221

fkie_cve-2026-2771

Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

GHSA-m65f-px5x-xq9x

Undefined behavior in the DOM: Core & HTML component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.

OESA-2026-1471 — firefox security update

Affected: openEuler:22.03-LTS-SP4: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es):

Heap buffer overflow vulnerability exists in libvpx component. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, and Firefox ESR < 115.32.1.(CVE-2026-2447)

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2757)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2758)

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2759)

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender compone…

openSUSE-SU-2026:10242-1 — firefox-esr-140.8.0-1.1 on GA media

firefox-esr-140.8.0-1.1 on GA media

RHSA-2026:3491 — Red Hat Security Advisory: firefox security update

libvpx: Heap buffer overflow in libvpx firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component firefox: thunderbird: Use-after-free in the JavaScript: GC component firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component firefox: thunderbird: Sandbox escape in the Graphics: WebRender component firefox: thunderbird: Integer overflow in the JavaScript: Standard Library component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component firefox: thunderbird: Undefined behavior in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the Audio/Video: Playback component firefox: thunderbird: Incorrect boundary conditions in the Web Audio component firefox: thunderbird: Integer overflow in the Audio/Video component firefox: thunderbird: Mitig…

SUSE-SU-2026:0812-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2026-2771

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

WID-SEC-W-2026-0497 — Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, sich erhöhte Rechte zu verschaffen, einen Denial-of-Service-Zustand herbeizuführen, sensible Informationen offenzulegen, Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder andere nicht spezifizierte Angriffe durchzuführen.