Most recent entries from all

ALSA-2026:21378 — Important: firefox security update

Affected: AlmaLinux:9: firefox, AlmaLinux:9: firefox-x11

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401) * firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956) * firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975) * firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955) * firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968) * firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954) * firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958) * firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946) * firefox: Privilege escalation in the Security component (CVE-2026-8970) * firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950) * firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974) * firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953) * firefox: Spoofing issue in the Form Autofil…

bdu:2026-12887

certfr-2026-avi-0615 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2026-avi-0615

EUVD-2026-319701

fkie_cve-2026-8955

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

GHSA-47hh-w7m9-q45x

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11.

OESA-2026-2392 — firefox security update

Affected: openEuler:24.03-LTS-SP3: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es):

A critical vulnerability has been discovered in Mozilla Firefox browser versions up to 150.0.2, classified as CWE-119 buffer error. The vulnerability allows the product to read from or write to memory locations outside the intended boundary of the buffer when performing operations on a memory buffer. This vulnerability affects confidentiality, integrity, and availability. Upgrading to version 150.0.3 eliminates this vulnerability.(CVE-2026-8388)

A vulnerability was found in Mozilla Firefox up to 150.0.2 (Web Browser). It has been declared as critical. As an impact it is known to affect confidentiality, integrity, and availability. Upgrading to version 150.0.3 eliminates this vulnerability.(CVE-2026-8391)

A sandbox escape vulnerability exists in the Profile Backup component of Mozilla Firefox. This vulnerability affects Firefox versions up to 150.0.2 and was fixed in version 150.0.3. An attacker could potentially exploi…

openSUSE-SU-2026:10813-1 — firefox-esr-140.11.0-1.1 on GA media

firefox-esr-140.11.0-1.1 on GA media

RHSA-2026:26174 — Red Hat Security Advisory: thunderbird security update

firefox: thunderbird: Use-after-free in the DOM: Networking component firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 firefox: thunderbird: Other issue in the WebRTC component firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component firefox: thunderbird: Other issue in the JavaScript Engine component firefox: thunderbird: Sandbox escape in the Profile Backup component firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component firefox: Same-origin policy bypass in the Networking: HTTP component firefox: Sandbox escape due to use-after-free in the Disability Access APIs component firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component firefox: thunderbird: Privilege escalation in the DOM: Workers component firefox: Integer overflow in the Networking: JAR component firefox: Privilege escalation in the Enterprise Policies component firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component firefox: Spoofing issue in the Form Autofill component firefox: Mitigation bypass in the DOM: Security component firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component firefox: Privilege escalatio…

RLSA-2026:21378 — Important: firefox security update

Affected: Rocky Linux:9: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

* firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

* firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

* firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

* firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)

* firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

* firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)

* firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

* firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)

* firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

* firefox: Privilege escalation in the Security component (CVE-2026-8970)

* firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

* firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

* firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

* firefox: Spoofing issue in the Form Autofill component (CVE-202…

SUSE-SU-2026:2039-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2026-8955

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

WID-SEC-W-2026-1606 — Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Code auszuführen, um Informationen offenzulegen, Sicherheitsbeschränkungen zu umgehen (z. B. Sandbox-Escape), den Benutzer zu täuschen, Berechtigungen zu eskalieren oder einen Denial-of-Service-Zustand herbeizuführen.