rpm package

almalinux/firefox

pkg:rpm/almalinux/firefox

Vulnerabilities (659)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-92032	Cri	9.6	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92031	Med	6.5	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92030	Med	5.4	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92029	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92028	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92027	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92026	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92025	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92024	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92023	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92022	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92021	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVE-2026-92020	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92019	Hig	8.1	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92018	Cri	9.6	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92017	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92016	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92015	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92014	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.
CVE-2026-92013	Hig	8.8	< 140.16.0-1.el10_2	140.16.0-1.el10_2	Sep 15, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

CVE-2026-92032CriSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Sandbox escape due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92031MedSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92030MedSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92029HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92028HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92027HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92026HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92025HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92024HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92023HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92022HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92021HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVE-2026-92020HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92019HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92018CriSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92017HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92016HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92015HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVE-2026-92014HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 115.41, Firefox ESR 140.16, and Thunderbird 140.16.
CVE-2026-92013HigSep 15, 2026
affected < 140.16.0-1.el10_2fixed 140.16.0-1.el10_2
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

Page 1 of 33