rpm package

almalinux/firefox-x11

pkg:rpm/almalinux/firefox-x11

Vulnerabilities (519)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-84145	Hig	7.5	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-84143	Cri	9.8	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-84131	Hig	8.8	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84124	Med	5.4	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84122	Med	5.4	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84121	Cri	9.6	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84120	Med	5.4	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84119	Cri	9.6	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Sep 1, 2026	Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-75874	Cri	10.0	< 140.15.0-1.el9_8.alma.1	140.15.0-1.el9_8.alma.1	Aug 18, 2026	Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
CVE-2026-74990	Cri	9.8	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-74987	Cri	9.8	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-74983	Hig	8.1	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74976	Med	6.5	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74974	Med	5.4	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74973	Med	4.2	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74972	Med	4.3	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74971	Med	4.3	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74969	Hig	8.8	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74967	Med	5.4	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74965	Hig	8.8	< 140.14.0-1.el9_8.alma.1	140.14.0-1.el9_8.alma.1	Aug 18, 2026	Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

CVE-2026-84145HigSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-84143CriSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-84131HigSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84124MedSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84122MedSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84121CriSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84120MedSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-84119CriSep 1, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
CVE-2026-75874CriAug 18, 2026
affected < 140.15.0-1.el9_8.alma.1fixed 140.15.0-1.el9_8.alma.1
Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2.
CVE-2026-74990CriAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-74987CriAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vul
CVE-2026-74983HigAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74976MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74974MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74973MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74972MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74971MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74969HigAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74967MedAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74965HigAug 18, 2026
affected < 140.14.0-1.el9_8.alma.1fixed 140.14.0-1.el9_8.alma.1
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Page 1 of 26