Opened 6 weeks ago

Closed 6 weeks ago

#23842 closed enhancement (fixed)

firefox-153.2.0esr

Reported by: Joe Locash Owned by: SecurityAdvisory
Priority: high Milestone: 98-Security
Component: BOOK Version: git
Severity: high Keywords:
Cc:

Description

New minor version. Release notes not available yet.

Change History (5)

comment:1 by Joe Locash, 6 weeks ago

Owner: changed from blfs-book to Joe Locash
Status: new → assigned

comment:2 by Joe Locash, 6 weeks ago

Priority: normal → high
Severity: normal → high

Security fixes:

  • CVE-2026-75874: Sandbox escape in the Remote Settings Client component (high)
  • CVE-2026-84118: Use-after-free in the JavaScript: GC component (high)
  • CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component (high)
  • CVE-2026-84120: Use-after-free in the Audio/Video component (high)
  • CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component (high)
  • CVE-2026-84122: Use-after-free in the Audio/Video component (high)
  • CVE-2026-84123: Privilege escalation due to use-after-free in the Graphics: WebGPU component (high)
  • CVE-2026-84124: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-84125: Use-after-free in the DOM: Core & HTML component (high)
  • CVE-2026-74952: Privilege escalation in the Application Update component (moderate)
  • CVE-2026-84129: Site isolation issue in the DOM: Navigation component (moderate)
  • CVE-2026-84130: Information disclosure in the Graphics: WebGPU component (moderate)
  • CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component (moderate)
  • CVE-2026-84132: Information disclosure in the Networking: HTTP component (moderate)
  • CVE-2026-84133: Site isolation issue in the DOM: Push Subscriptions component (low)
  • CVE-2026-84134: Other issue in the Profile Backup component (low)
  • CVE-2026-84136: Other issue in the DOM: Navigation component (low)
  • CVE-2026-84137: Spoofing issue in the DOM: Core & HTML component (low)
  • CVE-2026-84139: Clickjacking issue in the DOM: Events component (low)
  • CVE-2026-84140: Site isolation issue in the DOM: Navigation component (low)
  • CVE-2026-84141: Integer overflow in the Graphics: ImageLib component (low)
  • CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15 (high)
  • CVE-2026-84144: Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2 (high)
  • CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40 (high)

​https://www.mozilla.org/en-US/security/advisories/mfsa2026-85/

comment:3 by Joe Locash, 6 weeks ago

Milestone: 13.2 → 13.1

comment:4 by Joe Locash, 6 weeks ago

Milestone: 13.1 → 98-Security
Owner: changed from Joe Locash to SecurityAdvisory
Status: assigned → new

Fixed at bf1a8ca4b5. Leaving open for SA.

comment:5 by Bruce Dubbs, 6 weeks ago

Resolution: → fixed
Status: new → closed

Advisory sa-13.0-210 has been issued.

Note: See TracTickets for help on using tickets.