Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen
This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues:
Changes in MozillaFirefox:
Firefox Extended Support Release 153.2.0 ESR
* Fixed: Various security fixes.
MFSA 2026-85 (bsc#1278001):
* CVE-2026-75874: Sandbox escape in the Remote Settings Client component
* CVE-2026-84118: Use-after-free in the JavaScript: GC component
* CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation
component
* CVE-2026-84120: Use-after-free in the Audio/Video component
* CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security
This update for mozilla-nss fixes the following issues:
Update to NSS 3.112.3:
* CVE-2026-2781: Avoid integer overflow in platform-independent ghash (bsc#1258568)
This update for mozilla-nss fixes the following issues:
- Move NSS DB password hash away from SHA-1
Update to NSS 3.112.2:
* Prevent leaks during pkcs12 decoding.
* SEC_ASN1Decode* should ensure it has read as many bytes as each length field indicates
Update to NSS 3.112.1:
* restore support for finding certificates by decoded serial number.