SUSE-SU-2026:4928-1

SUSE-SU-2026:4928-1 · Security update for MozillaFirefox

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385): - CVE-2026-100801: Privilege escalation in the DLL Services component. - CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261). - CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component. - CVE-2026-117861: Sandbox escape in the DOM: Navigation component. - CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component. - CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component. - CVE-2026-117864: Sandbox escape in the Form Manager component. - CVE-2026-117865: Use-after-free in the JavaScript: GC component. - CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component. - CVE-2026-117867: Use-after-free in the Layout component. - CVE-2026-117868: Sandbox escape in the DOM: Networking component. - CVE-2026-117869: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117870: Use-after-free in the JavaScript Engine component. - CVE-2026-117871: Invalid pointer in the Graphics component. - CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component. - CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component. - CVE-2026-117874: Use-after-free in the Internationalization component. - CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component. - CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component. - CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component. - CVE-2026-117880: Use-after-free in the XML component. - CVE-2026-117881: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117882: Use-after-free in the Layout component. - CVE-2026-117883: Use-after-free in the DOM: HTML Parser component. - CVE-2026-117884: Use-after-free in the Networking component. - CVE-2026-117885: Use-after-free in the Layout: Grid component. - CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component. - CVE-2026-117887: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component. - CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component. - CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component. - CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component. - CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component. - CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component. - CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component. - CVE-2026-117895: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117896: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component. - CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component. - CVE-2026-117899: Use-after-free in the Networking: HTTP component. - CVE-2026-117900: Use-after-free in the DOM: Editor component. - CVE-2026-117901: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-117903: Use-after-free in the Audio/Video component. - CVE-2026-117904: Use-after-free in the JavaScript: GC component. - CVE-2026-117905: Use-after-free in the Audio/Video: Playback component. - CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component. - CVE-2026-117907: Use-after-free in the Networking component. - CVE-2026-117908: Use-after-free in the Graphics: ImageLib component. - CVE-2026-117909: Use-after-free in the JavaScript: GC component. - CVE-2026-117910: Invalid pointer in the JavaScript Engine component. - CVE-2026-117911: Use-after-free in the Audio/Video: Playback component. - CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component. - CVE-2026-117913: Use-after-free in the SVG component. - CVE-2026-117914: Use-after-free in the SVG component. - CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component. - CVE-2026-117916: Use-after-free in the XSLT component. - CVE-2026-117917: Invalid pointer in the Graphics: WebRender component. - CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-117919: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117920: Use-after-free in the DOM: HTML Parser component. - CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component. - CVE-2026-117922: Use-after-free in the Networking: WebSockets component. - CVE-2026-117923: Use-after-free in the Audio/Video component. - CVE-2026-117924: Use-after-free in the XSLT component. - CVE-2026-117925: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117926: Incorrect boundary conditions in the SVG component. - CVE-2026-117927: Use-after-free in the SVG component. - CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component. - CVE-2026-117929: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component. - CVE-2026-117931: Use-after-free in the DOM: Events component. - CVE-2026-117932: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component. - CVE-2026-117934: Use-after-free in the Layout component. - CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component. - CVE-2026-117936: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117937: Invalid pointer in the JavaScript Engine component. - CVE-2026-117938: Use-after-free in the Layout component. - CVE-2026-117939: Use-after-free in the XML component. - CVE-2026-117940: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component. - CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component. - CVE-2026-117943: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117944: Use-after-free in the Layout component. - CVE-2026-117945: Incorrect boundary conditions in the XML component. - CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component. - CVE-2026-117947: Use-after-free in the XML component. - CVE-2026-117948: Use-after-free in the SVG component. - CVE-2026-117949: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component. - CVE-2026-117951: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117952: Uninitialized memory in the Networking component. - CVE-2026-117953: Use-after-free in the DOM: Core & HTML component. - CVE-2026-117954: Use-after-free in the Layout: Positioned component. - CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component. - CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component. - CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component. - CVE-2026-117958: Site isolation issue in the Networking: HTTP component. - CVE-2026-117959: Site isolation issue in the DOM: Service Workers component. - CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component. - CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component. - CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. - CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component. - CVE-2026-117964: Use-aft

Correctif disponible

Publication

2026-10-29T08:52:15Z

Mise à jour

2026-10-31T18:00:04.936593677Z

Pile logicielle: system

Vérifiez votre serveur →