SUSE-SU-2026:4156-1

SUSE-SU-2026:4156-1 · Security update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

This update for MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen fixes the following issues: Changes in MozillaFirefox: Firefox Extended Support Release 153.2.0 ESR * Fixed: Various security fixes. MFSA 2026-85 (bsc#1278001): * CVE-2026-75874: Sandbox escape in the Remote Settings Client component * CVE-2026-84118: Use-after-free in the JavaScript: GC component * CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component * CVE-2026-84120: Use-after-free in the Audio/Video component * CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component * CVE-2026-84122: Use-after-free in the Audio/Video component * CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component * CVE-2026-84124: Use-after-free in the DOM: Core & HTML component * CVE-2026-84125: Use-after-free in the DOM: Core & HTML component * CVE-2026-74952: Privilege escalation in the Application Update component * CVE-2026-84129: Site isolation issue in the DOM: Navigation component * CVE-2026-84130: Information disclosure in the Graphics: WebGPU component * CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component * CVE-2026-84132: Information disclosure in the Networking: HTTP component * CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component * CVE-2026-84134: Other issue in the Profile Backup component * CVE-2026-84136: Other issue in the DOM: Navigation component * CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component * CVE-2026-84139: Clickjacking issue in the DOM: Events component * CVE-2026-84140: Site isolation issue in the DOM: Navigation component * CVE-2026-84141: Integer overflow in the Graphics: ImageLib component * CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 * CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2 * CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 * Fixed: Various security fixes. MFSA 2026-77 (bsc#1274867): * CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component * CVE-2026-74935: Privilege escalation in the DOM: Networking component * CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component * CVE-2026-74937: Use-after-free in the JavaScript: GC component * CVE-2026-74938: Mitigation bypass in the JavaScript: GC component * CVE-2026-74939: Privilege escalation in the DOM: Navigation component * CVE-2026-74940: Use-after-free in the Graphics: Text component * CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component * CVE-2026-74942: Privilege escalation in the Remote Settings Client component * CVE-2026-74943: Use-after-free in the Graphics: ImageLib component * CVE-2026-74944: Use-after-free in the DOM: Core & HTML component * CVE-2026-74945: Information disclosure in the Graphics: Text component * CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component * CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component * CVE-2026-74948: Information disclosure in the Graphics component * CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component * CVE-2026-74950: Privilege escalation in the Downloads API component * CVE-2026-74953: Privilege escalation in the Networking: Cookies component * CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component * CVE-2026-74955: Privilege escalation in the Request Handling component * CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component * CVE-2026-74957: Mitigation bypass in the Safe Browsing component * CVE-2026-74958: Information disclosure in the WebRTC component * CVE-2026-74959: Mitigation bypass in the Storage: Cache API component * CVE-2026-74960: Site isolation issue in the WebExtensions component * CVE-2026-74961: Side-channel in the Web Audio component * CVE-2026-74962: Site isolation issue in the Networking: Cookies component * CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component * CVE-2026-74964: Integer overflow in the Graphics component * CVE-2026-74965: Privilege escalation in the Shell Integration component * CVE-2026-74966: Information disclosure in the Form Autofill component * CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component * CVE-2026-74968: Site isolation issue in the Graphics: WebRender component * CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component * CVE-2026-74970: Site isolation issue in the Graphics component * CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component * CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component * CVE-2026-74973: Race condition, use-after-free in the Graphics component * CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component * CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component * CVE-2026-74977: Integer overflow in the Graphics component * CVE-2026-74978: Clickjacking issue in the Widget component * CVE-2026-74979: Mitigation bypass in the Add-ons Manager component * CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component * CVE-2026-74982: Denial-of-service in the Widget component * CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component * CVE-2026-74984: Race condition in the JavaScript Engine component * CVE-2026-74985: Privilege escalation in the Enterprise Policies component * CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component * CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 * CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154 * CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 - Firefox Extended Support Release 153.0esr ESR * New: ## General - Firefox now includes a new profile management system that helps you separate your online life into distinct profiles for work, school, vacation planning, or whatever you choose. Profiles can be customized with names, avatars, and color themes while keeping tabs, bookmarks, passwords, and browsing history separate. Built-in profile backup and restore also makes it easier to migrate to a new device or recover your browsing data. - Split View lets you view two webpages side-by-side in a single browser window, with additional options to quickly open links in Split View, rearrange pages, and search open tabs. - The Firefox address bar has gained several new capabilities, including built-in unit and time zone conversion, quick actions such as muting all browser audio, and direct search results as you type. - Firefox now supports copying links directly to highlighted text on a webpage for easier sharing. - Firefox Settings has been redesigned with improved organization and navigation, making it easier to find and customize browser preferences. * New: ## AI Firefox introduced several new AI-powered features, including on-device tab organization, AI-assisted link previews, integrated AI search, and centralized controls for managing AI features. Whenever possible, these features perform processing locally to help protect user privacy. * New: ## Sidebar and Tabs - Firefox continues to improve tab management with enhancements t

Corrección disponible

Publicación

2026-09-14T09:08:05Z

Actualización

2026-09-15T17:00:04.812000192Z

Pila tecnológica: system

Comprueba tu servidor →