rpm package

opensuse/firefox-esr&distro=openSUSE Tumbleweed

pkg:rpm/opensuse/firefox-esr&distro=openSUSE%20Tumbleweed

Vulnerabilities (2,418)

CVE	Sev	CVSS	Affected versions	Fixed in	Published	Description
CVE-2026-8958	Hig	8.6	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957	Hig	8.8	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956	Cri	9.8	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8955	Hig	8.8	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954	Hig	7.5	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953	Cri	9.6	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8952	Hig	8.8	< 153.0-1.1	153.0-1.1	May 19, 2026	Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8951	Med	6.5	< 153.0-1.1	153.0-1.1	May 19, 2026	Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950	Cri	9.3	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8949	Hig	7.5	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948	Cri	9.1	< 153.0-1.1	153.0-1.1	May 19, 2026	Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8947	Hig	7.3	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946	Hig	7.5	< 140.11.0-1.1	140.11.0-1.1	May 19, 2026	Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8945	Hig	7.5	< 153.0-1.1	153.0-1.1	May 19, 2026	Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8401	Cri	9.8	< 140.11.0-1.1	140.11.0-1.1	May 12, 2026	Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8391	Med	5.3	< 140.11.0-1.1	140.11.0-1.1	May 12, 2026	Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8388	Med	6.5	< 140.11.0-1.1	140.11.0-1.1	May 12, 2026	Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8094	Cri	9.8	< 140.10.2-1.1	140.10.2-1.1	May 7, 2026	Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
CVE-2026-8093	Hig	8.1	< 153.0-1.1	153.0-1.1	May 7, 2026	Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.
CVE-2026-8092	Hig	8.1	< 140.10.2-1.1	140.10.2-1.1	May 7, 2026	Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed

CVE-2026-8958HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8957HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8956CriMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8955HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8954HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8953CriMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8952HigMay 19, 2026
affected < 153.0-1.1fixed 153.0-1.1
Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8951MedMay 19, 2026
affected < 153.0-1.1fixed 153.0-1.1
Spoofing issue in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8950CriMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8949HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8948CriMay 19, 2026
affected < 153.0-1.1fixed 153.0-1.1
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
CVE-2026-8947HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8946HigMay 19, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-8945HigMay 19, 2026
affected < 153.0-1.1fixed 153.0-1.1
Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.
CVE-2026-8401CriMay 12, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8391MedMay 12, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8388MedMay 12, 2026
affected < 140.11.0-1.1fixed 140.11.0-1.1
Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.
CVE-2026-8094CriMay 7, 2026
affected < 140.10.2-1.1fixed 140.10.2-1.1
Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.
CVE-2026-8093HigMay 7, 2026
affected < 153.0-1.1fixed 153.0-1.1
Memory safety bugs present in Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.
CVE-2026-8092HigMay 7, 2026
affected < 140.10.2-1.1fixed 140.10.2-1.1
Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed

Page 10 of 121