Most recent entries from all

ALSA-2026:3338 — Important: firefox security update

Affected: AlmaLinux:8: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447) * firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785) * firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793) * firefox: Undefined behavior in the DOM: Core & HTML component (CVE-2026-2771) * firefox: Integer overflow in the Audio/Video component (CVE-2026-2774) * firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776) * firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781) * firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766) * firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769) * firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787) * firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768) * firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783) * firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788) * firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784) * firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026…

bdu:2026-12116

certfr-2026-avi-0204 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2026-avi-0204

cnvd-2026-20782

EUVD-2026-337409

fkie_cve-2026-2776

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

GHSA-v33x-35cm-8gjc

Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, and Firefox ESR < 140.8.

OESA-2026-1471 — firefox security update

Affected: openEuler:22.03-LTS-SP4: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es):

Heap buffer overflow vulnerability exists in libvpx component. This vulnerability affects Firefox < 147.0.4, Firefox ESR < 140.7.1, and Firefox ESR < 115.32.1.(CVE-2026-2447)

Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2757)

Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2758)

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox < 148, Firefox ESR < 115.33, Firefox ESR < 140.8, Thunderbird < 148, and Thunderbird < 140.8.(CVE-2026-2759)

Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender compone…

openSUSE-SU-2026:10242-1 — firefox-esr-140.8.0-1.1 on GA media

firefox-esr-140.8.0-1.1 on GA media

RHSA-2026:3491 — Red Hat Security Advisory: firefox security update

libvpx: Heap buffer overflow in libvpx firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component firefox: thunderbird: Use-after-free in the JavaScript: GC component firefox: thunderbird: Incorrect boundary conditions in the Graphics: ImageLib component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component firefox: thunderbird: Sandbox escape in the Graphics: WebRender component firefox: thunderbird: Integer overflow in the JavaScript: Standard Library component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript Engine component firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component firefox: thunderbird: Sandbox escape in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the Storage: IndexedDB component firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component firefox: thunderbird: Undefined behavior in the DOM: Core & HTML component firefox: thunderbird: Use-after-free in the Audio/Video: Playback component firefox: thunderbird: Incorrect boundary conditions in the Web Audio component firefox: thunderbird: Integer overflow in the Audio/Video component firefox: thunderbird: Mitig…

SUSE-SU-2026:0812-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2026-2776

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

WID-SEC-W-2026-0497 — Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, sich erhöhte Rechte zu verschaffen, einen Denial-of-Service-Zustand herbeizuführen, sensible Informationen offenzulegen, Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen oder andere nicht spezifizierte Angriffe durchzuführen.