{"id":"CVE-2026-15719","aliases":["ALSA-2026:47101","ALSA-2026:47104","ALSA-2026:47105","ALSA-2026:49621","ALSA-2026:49921","ALSA-2026:49922","CLSA-2026-1785839724","DEBIAN-CVE-2026-15719","EUVD-2026-43663","GHSA-hqh9-m4jx-3x67","MGASA-2026-0325","MGASA-2026-0326","OESA-2026-3195","OESA-2026-3196","OESA-2026-3225","OESA-2026-3226","OESA-2026-3227","OESA-2026-3228","RHSA-2026:47101","RHSA-2026:47104","RHSA-2026:47105","RHSA-2026:49621","RHSA-2026:49921","RHSA-2026:49922","RHSA-2026:53444","RHSA-2026:53445","RHSA-2026:53446","RHSA-2026:53453","RHSA-2026:53454","RHSA-2026:53455","RHSA-2026:53475","RHSA-2026:54180","RHSA-2026:54181","RHSA-2026:54182","RHSA-2026:54185","RHSA-2026:54248","RHSA-2026:54249","RHSA-2026:54259","RHSA-2026:54339","RLSA-2026:47101","RLSA-2026:47104","RLSA-2026:47105","RLSA-2026:49621","RLSA-2026:49921","RLSA-2026:49922","SUSE-SU-2026:23115-1","SUSE-SU-2026:23137-1","SUSE-SU-2026:3200-1","SUSE-SU-2026:3221-1","SUSE-SU-2026:3546-1","UBUNTU-CVE-2026-15719","openSUSE-SU-2026:11311-1","openSUSE-SU-2026:11329-1","openSUSE-SU-2026:11359-1","openSUSE-SU-2026:21519-1"],"status":"published","title":"Site isolation issue in the DOM: Navigation component","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00339,"percentile":0.27536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-07-14T12:15:47Z","modified":"2026-10-29T11:32:24Z","fixes":[{"ecosystem":"Debian:12","package":"firefox-esr","fixed_in":["140.13.0esr-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"firefox-esr","fixed_in":["140.13.0esr-1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"firefox-esr","fixed_in":["140.13.0esr-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"thunderbird","fixed_in":["1:140.13.0esr-2~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"thunderbird","fixed_in":["1:140.13.0esr-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"thunderbird","fixed_in":["1:140.13.0esr-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el10_2"}]}],"bundled":32},{"source":"osv","ecosystem":"AlmaLinux:9","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el9_8.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"AlmaLinux:9","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el9_8.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"AlmaLinux:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el8_10.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"AlmaLinux:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el10_2.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"AlmaLinux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el9_8.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"AlmaLinux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el8_10.alma.1"}]}],"bundled":33},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.el9_2.alma.1.tuxcare.els1"}]}],"bundled":35},{"source":"osv","ecosystem":"Debian:12","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0esr-1~deb12u1"}]}],"versions":["102.11.0esr-1","102.12.0esr-1","102.12.0esr-1~deb10u1","102.12.0esr-1~deb11u1","102.12.0esr-1~deb12u1","102.13.0esr-1","102.13.0esr-1~deb10u1","102.13.0esr-1~deb11u1","102.13.0esr-1~deb12u1","102.14.0esr-1~deb10u1","102.14.0esr-1~deb11u1","102.14.0esr-1~deb12u1","102.15.0esr-1~deb10u1","102.15.0esr-1~deb11u1","102.15.0esr-1~deb12u1","102.15.1esr-1~deb10u1","102.15.1esr-1~deb11u1","102.15.1esr-1~deb12u1","115.0.2esr-1","115.1.0esr-1","115.10.0esr-1","115.10.0esr-1~deb10u1","115.10.0esr-1~deb11u1","115.10.0esr-1~deb12u1","115.11.0esr-1","115.11.0esr-1~deb10u1","115.11.0esr-1~deb11u1","115.11.0esr-1~deb12u1","115.12.0esr-1","115.12.0esr-1~deb10u1","115.12.0esr-1~deb11u1","115.12.0esr-1~deb12u1","115.13.0esr-1","115.13.0esr-1~deb11u1","115.13.0esr-1~deb12u1","115.13.0esr-2","115.14.0esr-1","115.14.0esr-1~deb11u1","115.14.0esr-1~deb12u1","115.15.0esr-1","115.15.0esr-1~deb11u1","115.15.0esr-1~deb12u1","115.2.0esr-1","115.2.1esr-1","115.3.0esr-1","115.3.0esr-1~deb10u1","115.3.0esr-1~deb11u1","115.3.0esr-1~deb12u1","115.3.1esr-1~deb10u1","115.3.1esr-1~deb11u1","115.4.0esr-1","115.4.0esr-1~deb10u1","115.4.0esr-1~deb11u1","115.4.0esr-1~deb12u1","115.5.0esr-1","115.5.0esr-1~deb10u1","115.5.0esr-1~deb11u1","115.5.0esr-1~deb12u1","115.6.0esr-1","115.6.0esr-1~deb10u1","115.6.0esr-1~deb11u1","115.6.0esr-1~deb12u1","115.7.0esr-1","115.7.0esr-1~deb10u1","115.7.0esr-1~deb11u1","115.7.0esr-1~deb12u1","115.8.0esr-1","115.8.0esr-1~deb10u1","115.8.0esr-1~deb11u1","115.8.0esr-1~deb12u1","115.9.0esr-1","115.9.0esr-1~deb11u1","115.9.0esr-1~deb12u1","115.9.0esr-2","115.9.1esr-1","115.9.1esr-1~deb10u1","115.9.1esr-1~deb11u1","115.9.1esr-1~deb12u1","128.10.0esr-1","128.10.0esr-1~deb12u1","128.10.1esr-1","128.10.1esr-1~deb11u1","128.10.1esr-1~deb12u1","128.11.0esr-1","128.11.0esr-1~deb11u1","128.11.0esr-1~deb12u1","128.12.0esr-1","128.12.0esr-1~deb11u1","128.12.0esr-1~deb12u1","128.13.0esr-1","128.13.0esr-1~deb11u1","128.13.0esr-1~deb12u1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","128.3.0esr-1","128.3.0esr-1~deb11u1","128.3.0esr-1~deb11u2","128.3.0esr-1~deb12u1","128.3.0esr-2","128.3.1esr-1","128.3.1esr-1~deb11u1","128.3.1esr-1~deb12u1","128.3.1esr-2","128.4.0esr-1","128.4.0esr-1~deb11u1","128.4.0esr-1~deb12u1","128.5.0esr-1","128.5.0esr-1~deb11u1","128.5.0esr-1~deb12u1","128.5.1esr-1","128.6.0esr-1","128.6.0esr-1~deb11u1","128.6.0esr-1~deb11u2","128.6.0esr-1~deb11u3","128.6.0esr-1~deb12u1","128.6.0esr-2","128.6.0esr-3","128.6.0esr-4","128.7.0esr-1","128.7.0esr-1~deb11u1","128.7.0esr-1~deb12u1","128.8.0esr-1","128.8.0esr-1~deb11u1","128.8.0esr-1~deb12u1","128.9.0esr-1","128.9.0esr-1~deb11u1","128.9.0esr-1~deb12u1","128.9.0esr-2","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1~deb11u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0esr-1~deb13u1"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0esr-1"}]}],"versions":["128.13.0esr-1","128.14.0esr-1","128.14.0esr-1~deb11u1","128.14.0esr-1~deb12u1","128.14.0esr-1~deb13u1","140.10.0esr-1","140.10.0esr-1~deb11u1","140.10.0esr-1~deb12u1","140.10.0esr-1~deb13u1","140.10.1esr-1","140.10.1esr-1~deb11u1","140.10.1esr-1~deb12u1","140.10.1esr-1~deb13u1","140.10.2esr-1","140.10.2esr-1~deb11u1","140.10.2esr-1~deb12u1","140.10.2esr-1~deb13u1","140.11.0esr-1","140.11.0esr-1~deb11u1","140.11.0esr-1~deb12u1","140.11.0esr-1~deb13u1","140.12.0esr-1","140.12.0esr-1~deb11u1","140.12.0esr-1~deb12u1","140.12.0esr-1~deb13u1","140.13.0esr-1~deb11u1","140.13.0esr-1~deb12u1","140.13.0esr-1~deb13u1","140.3.0esr-1","140.3.0esr-1~deb11u1","140.3.0esr-1~deb11u2","140.3.0esr-1~deb12u1","140.3.0esr-1~deb13u1","140.3.0esr-2","140.3.1esr-1","140.3.1esr-1~deb11u1","140.3.1esr-1~deb12u1","140.3.1esr-1~deb13u1","140.3.1esr-2","140.4.0esr-1","140.4.0esr-1~deb11u1","140.4.0esr-1~deb12u1","140.4.0esr-1~deb13u1","140.5.0esr-1","140.5.0esr-1~deb11u1","140.5.0esr-1~deb12u1","140.5.0esr-1~deb13u1","140.6.0esr-1","140.6.0esr-1~deb11u1","140.6.0esr-1~deb12u1","140.6.0esr-1~deb13u1","140.7.0esr-1","140.7.0esr-1~deb11u1","140.7.0esr-1~deb12u1","140.7.0esr-1~deb13u1","140.8.0esr-1","140.8.0esr-1~deb11u1","140.8.0esr-1~deb12u1","140.8.0esr-1~deb13u1","140.9.0esr-1","140.9.0esr-1~deb11u1","140.9.0esr-1~deb12u1","140.9.0esr-1~deb13u1","140.9.1esr-1","140.9.1esr-1~deb11u1","140.9.1esr-1~deb12u1","140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:12","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:140.13.0esr-2~deb12u1"}]}],"versions":["1:102.11.0-1","1:102.12.0-1","1:102.12.0-1~deb10u1","1:102.12.0-1~deb11u1","1:102.12.0-1~deb12u1","1:102.13.0-1","1:102.13.0-1~deb10u1","1:102.13.0-1~deb11u1","1:102.13.0-1~deb12u1","1:102.13.1-1","1:102.13.1-1~deb10u1","1:102.13.1-1~deb11u1","1:102.13.1-1~deb12u1","1:102.14.0-1~deb10u1","1:102.14.0-1~deb11u1","1:102.14.0-1~deb12u1","1:102.15.0-1~deb10u1","1:102.15.0-1~deb11u1","1:102.15.0-1~deb12u1","1:102.15.1-1~deb10u1","1:102.15.1-1~deb11u1","1:102.15.1-1~deb12u1","1:103.0~b5-1","1:104.0~b2-1","1:110.0~b4-1","1:112.0~b1-1","1:113.0~b3-1","1:114.0~b2-1","1:115.0-1","1:115.0.1-1","1:115.0.1-2","1:115.0~b4-1","1:115.0~b6-1","1:115.1.0-1","1:115.1.1-1","1:115.10.1-1","1:115.10.1-1~deb10u1","1:115.10.1-1~deb11u1","1:115.10.1-1~deb12u1","1:115.11.0-1","1:115.11.0-1~deb10u1","1:115.11.0-1~deb11u1","1:115.11.0-1~deb12u1","1:115.12.0-1","1:115.12.0-1~deb10u1","1:115.12.0-1~deb11u1","1:115.12.0-1~deb12u1","1:115.13.0-1","1:115.13.0-1~deb11u1","1:115.13.0-1~deb12u1","1:115.14.0-1~deb11u1","1:115.14.0-1~deb12u1","1:115.15.0-1~deb11u1","1:115.15.0-1~deb12u1","1:115.16.0esr-1~deb11u1","1:115.16.0esr-1~deb12u1","1:115.2.0-1","1:115.2.2-1","1:115.3.0-1","1:115.3.0-1~deb12u1","1:115.3.1-1","1:115.3.1-1~deb10u1","1:115.3.1-1~deb11u1","1:115.3.1-1~deb12u1","1:115.4.1-1","1:115.4.1-1~deb10u1","1:115.4.1-1~deb11u1","1:115.4.1-1~deb12u1","1:115.5.0-1","1:115.5.0-1~deb10u1","1:115.5.0-1~deb11u1","1:115.5.0-1~deb12u1","1:115.5.1-1","1:115.5.2-1","1:115.6.0-1","1:115.6.0-1~deb10u1","1:115.6.0-1~deb11u1","1:115.6.0-1~deb12u1","1:115.7.0-1","1:115.7.0-1~deb10u1","1:115.7.0-1~deb11u1","1:115.7.0-1~deb12u1","1:115.8.0-1","1:115.8.0-1~deb10u1","1:115.8.0-1~deb11u1","1:115.8.0-1~deb12u1","1:115.8.1-1","1:115.9.0-1","1:115.9.0-1~deb10u1","1:115.9.0-1~deb11u1","1:115.9.0-1~deb12u1","1:116.0~b7-1","1:117.0~b5-1","1:120.0~b1-1","1:121.0~b3-1","1:122.0~b2-1","1:124.0~b5-1","1:125.0~b3-1","1:127.0~b5-1","1:128.0esr-1","1:128.0~b5-1","1:128.1.0esr-1","1:128.1.1esr-1","1:128.10.0esr-1","1:128.10.0esr-1~deb11u1","1:128.10.0esr-1~deb12u1","1:128.10.1esr-1","1:128.10.1esr-1~deb11u1","1:128.10.1esr-1~deb12u1","1:128.11.0esr-1","1:128.11.0esr-1~deb11u1","1:128.11.0esr-1~deb12u1","1:128.12.0esr-1","1:128.12.0esr-1~deb11u1","1:128.12.0esr-1~deb12u1","1:128.13.0esr-1","1:128.13.0esr-1~deb11u1","1:128.13.0esr-1~deb12u1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:128.2.0esr-1","1:128.2.1esr-1","1:128.2.3esr-1","1:128.3.0esr-1","1:128.3.2esr-1","1:128.4.0esr-1","1:128.4.0esr-1~deb11u1","1:128.4.0esr-1~deb12u1","1:128.4.2esr-1","1:128.4.3esr-1","1:128.4.3esr-1~deb11u1","1:128.4.3esr-1~deb12u1","1:128.5.0esr-1","1:128.5.0esr-1~deb11u1","1:128.5.0esr-1~deb12u1","1:128.5.2esr-1","1:128.6.0esr-1","1:128.6.0esr-1~deb11u1","1:128.6.0esr-1~deb12u1","1:128.7.0esr-1","1:128.7.0esr-1~deb11u1","1:128.7.0esr-1~deb12u1","1:128.8.0esr-1","1:128.8.0esr-1~deb11u1","1:128.8.0esr-1~deb12u1","1:128.9.0esr-1","1:128.9.0esr-1~deb11u1","1:128.9.0esr-1~deb12u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2~deb11u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:140.13.0esr-2~deb13u1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.13.0esr-1","1:140.13.0esr-2~deb11u1","1:140.13.0esr-2~deb12u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:140.13.0esr-1"}]}],"versions":["1:128.13.0esr-1","1:128.14.0esr-1","1:128.14.0esr-1~deb11u1","1:128.14.0esr-1~deb12u1","1:128.14.0esr-1~deb13u1","1:129.0~b6-1","1:130.0~b3-1","1:132.0~b6-1","1:135.0-1","1:136.0-1","1:137.0-1","1:138.0-1","1:140.0.1esr-1","1:140.1.0esr-1","1:140.1.1esr-1","1:140.10.0esr-1","1:140.10.0esr-1~deb11u1","1:140.10.0esr-1~deb12u1","1:140.10.0esr-1~deb13u1","1:140.10.1esr-1","1:140.10.1esr-1~deb11u1","1:140.10.1esr-1~deb12u1","1:140.10.1esr-1~deb13u1","1:140.10.2esr-1","1:140.10.2esr-1~deb11u1","1:140.10.2esr-1~deb12u1","1:140.10.2esr-1~deb13u1","1:140.11.0esr-1","1:140.11.0esr-1~deb11u1","1:140.11.0esr-1~deb12u1","1:140.11.0esr-1~deb13u1","1:140.12.0esr-1","1:140.12.0esr-1~deb11u1","1:140.12.0esr-1~deb12u1","1:140.12.0esr-1~deb13u1","1:140.2.0esr-1","1:140.3.0esr-1","1:140.3.0esr-1~deb11u1","1:140.3.0esr-1~deb12u1","1:140.3.0esr-1~deb13u1","1:140.3.1esr-1","1:140.4.0esr-1","1:140.4.0esr-1~deb11u1","1:140.4.0esr-1~deb12u1","1:140.4.0esr-1~deb13u1","1:140.5.0esr-1","1:140.5.0esr-1~deb11u1","1:140.5.0esr-1~deb12u1","1:140.5.0esr-1~deb13u1","1:140.6.0esr-1","1:140.6.0esr-1~deb11u1","1:140.6.0esr-1~deb12u1","1:140.6.0esr-1~deb13u1","1:140.7.0esr-1","1:140.7.0esr-1~deb11u1","1:140.7.0esr-1~deb12u1","1:140.7.0esr-1~deb13u1","1:140.7.1esr-1","1:140.7.1esr-1~deb11u1","1:140.7.1esr-1~deb12u1","1:140.7.1esr-1~deb13u1","1:140.8.0esr-1","1:140.8.0esr-1~deb11u1","1:140.8.0esr-1~deb12u1","1:140.8.0esr-1~deb13u1","1:140.9.0esr-1","1:140.9.0esr-1~deb11u1","1:140.9.0esr-1~deb12u1","1:140.9.0esr-1~deb13u1","1:140.9.1esr-1","1:140.9.1esr-1~deb11u1","1:140.9.1esr-1~deb12u1","1:140.9.1esr-1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260714.00-1.mga10"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:10","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.126.0-1.mga10"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga10"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:10","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga10"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"rootcerts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20260714.00-1.mga9"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.126.0-1.mga9"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga9"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"firefox-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga9"}]}],"bundled":32},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga10"}]}],"bundled":64},{"source":"osv","ecosystem":"Mageia:10","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga10"}]}],"bundled":64},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga9"}]}],"bundled":64},{"source":"osv","ecosystem":"Mageia:9","package":"thunderbird-l10n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.mga9"}]}],"bundled":64},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.oe2403sp4"}]}],"bundled":33},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.oe2403sp3"}]}],"bundled":33},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-2.oe2403sp1"}]}],"bundled":32},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-2.oe2403sp3"}]}],"bundled":32},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-2.oe2403sp4"}]}],"bundled":32},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-2.oe2203sp4"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":32},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"thunderbird-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"thunderbird-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_0"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_4"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el7_9"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el7_9"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"firefox-x11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_6"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"firefox-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"firefox-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Rocky Linux:10","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":32},{"source":"osv","ecosystem":"Rocky Linux:9","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Rocky Linux:8","package":"firefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"Rocky Linux:10","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el10_2"}]}],"bundled":33},{"source":"osv","ecosystem":"Rocky Linux:9","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el9_8"}]}],"bundled":33},{"source":"osv","ecosystem":"Rocky Linux:8","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:140.13.0-1.el8_10"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-160000.1.1"}]}],"bundled":61},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-160000.1.1"}]}],"bundled":61},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-160000.1.1"}]}],"bundled":61},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-160000.1.1"}]}],"bundled":61},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-112.324.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-112.324.2"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP7","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.152.248.1"}]}],"bundled":32},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.8.280.1"}]}],"bundled":33},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP7","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-150200.8.280.1"}]}],"bundled":33},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.3.1-0ubuntu3","52.3.1-7fakesync1","52.8.1-0ubuntu0.18.04.1","52.9.1-0ubuntu0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mozjs38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["38.8.0~repack1-0ubuntu1","38.8.0~repack1-0ubuntu3","38.8.0~repack1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs68","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["68.5.0-1~fakesync","68.5.0-2~fakesync","68.6.0-1","68.6.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mozjs52","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["52.9.1-1build1","52.9.1-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.11.0-0ubuntu0.22.04.1","102.12.0-0ubuntu0.22.04.1","102.13.0-0ubuntu0.22.04.1","102.15.1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs78","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["78.13.0-1","78.15.0-2","78.15.0-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mozjs91","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["91.5.1-0ubuntu1","91.6.0-1","91.6.0-2","91.7.0-2","91.10.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"thunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:91.1.2+build1-0ubuntu1","1:91.3.0+build2-0ubuntu1","1:91.3.1+build1-0ubuntu1","1:91.3.2+build1-0ubuntu1","1:91.4.0+build1.1-0ubuntu1","1:91.4.0+build2-0ubuntu1","1:91.5.0+build1-0ubuntu1","1:91.5.1+build1-0ubuntu1","1:91.6.1+build1-0ubuntu1","1:91.7.0+build1-0ubuntu1","1:91.7.0+build2-0ubuntu1","1:91.8.0+build2-0ubuntu1","1:91.9.1+build1-0ubuntu0.22.04.1","1:91.11.0+build2-0ubuntu0.22.04.1","1:102.2.2+build1-0ubuntu0.22.04.1","1:102.4.2+build2-0ubuntu0.22.04.1","1:102.7.1+build2-0ubuntu0.22.04.1","1:102.8.0+build2-0ubuntu0.22.04.1","1:102.9.0+build1-0ubuntu0.22.04.1","1:102.10.0+build2-0ubuntu0.22.04.1","1:102.11.0+build1-0ubuntu0.22.04.1","1:102.13.0+build1-0ubuntu0.22.04.1","1:102.15.0+build1-0ubuntu0.22.04.1","1:102.15.1+build1-0ubuntu0.22.04.1","1:115.3.1+build1-0ubuntu0.22.04.2","1:115.4.1+build1-0ubuntu0.22.04.1","1:115.5.0+build1-0ubuntu0.22.04.1","1:115.6.0+build2-0ubuntu0.22.04.1","1:115.8.1+build1-0ubuntu0.22.04.1","1:115.9.0+build1-0ubuntu0.22.04.1","1:115.10.1+build1-0ubuntu0.22.04.1","1:115.11.0+build2-0ubuntu0.22.04.1","1:115.12.0+build3-0ubuntu0.22.04.1","1:115.13.0+build5-0ubuntu0.22.04.1","1:115.15.0+build1-0ubuntu0.22.04.1","1:115.16.0+build2-0ubuntu0.22.04.1","1:115.18.0+build1-0ubuntu0.22.04.1","1:128.12.0+build1-0ubuntu0.22.04.1","1:140.7.1+build1-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs102","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["102.15.1-1","102.15.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mozjs115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["115.3.0-0ubuntu1","115.4.0-2","115.5.0-1","115.6.0-1","115.7.0-4","115.8.0-1","115.9.0-1","115.9.0-1build1","115.10.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"152.0.6-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.1"}]}],"bundled":32},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaThunderbird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-1.1"}]}],"bundled":33},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"140.13.0-160000.1.1"}]}],"bundled":61}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"thunderbird"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=2043820","tags":["Permissions Required","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-67/","tags":["Vendor Advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-69/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15719","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-67"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-69"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70"},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72"},{"url":"https://github.com/advisories/GHSA-hqh9-m4jx-3x67"},{"url":"https://access.redhat.com/errata/RHSA-2026:47101","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15718","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15719","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16349","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16350","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16351","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16353","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16354","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16355","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16356","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16357","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16358","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16359","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16360","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16361","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16362","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16363","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16368","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16369","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16371","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16374","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16375","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16377","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16379","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16381","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16383","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16396","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16405","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16412","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499973","tags":["report"]},{"url":"https://bugzilla.redhat.com/2499974","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503415","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503416","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503420","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503423","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503425","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503430","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503432","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503434","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503439","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503440","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503444","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503451","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503454","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503456","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503463","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503472","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503473","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503485","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503489","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503491","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503497","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503498","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503500","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503501","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503505","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503512","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503513","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503517","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503521","tags":["report"]},{"url":"https://bugzilla.redhat.com/2503527","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-47101.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47104","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-56208","tags":["report"]},{"url":"https://bugzilla.redhat.com/2490799","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-47104.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:47105","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-47105.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49621","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14899","tags":["report"]},{"url":"https://bugzilla.redhat.com/2506217","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-49621.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49921","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-49921.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49922","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-49922.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1785839724.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16349","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16354","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16355","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16357","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16361","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16362","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16363","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16369","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16371","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16374","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16377","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16381","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16383","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16396","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16405","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57962","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57963","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-15719","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0325.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35981","tags":["report"]},{"url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_126.html","tags":["web"]},{"url":"https://www.firefox.com/en-US/firefox/140.13.0/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0326.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35982","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35863","tags":["report"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.13.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird/#thunderbird140.13","tags":["web"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.12.0esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-61/","tags":["advisory"]},{"url":"https://www.thunderbird.net/en-US/thunderbird/140.12.1esr/releasenotes/","tags":["web"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-64/","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3195","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3196","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3225","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3226","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3227","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3228","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503425","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503463","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503472","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503497","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503498","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503501","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503512","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2503527","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47101.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15718","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15719","tags":["advisory","report"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15719","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15719","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16349","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16349","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16349","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16350","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16350","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16350","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16351","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16351","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16351","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16352","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16352","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16352","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16353","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16353","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16353","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16354","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16354","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16354","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16355","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16356","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16356","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16356","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16357","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16357","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16357","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16358","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16358","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16358","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16359","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16359","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16359","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16360","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16361","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16361","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16361","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16362","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16362","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16362","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16363","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16363","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16363","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16368","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16368","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16368","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16369","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16369","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16369","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16371","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16371","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16371","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-84/#CVE-2026-16371","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-87/#CVE-2026-16371","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16374","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16374","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16374","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16375","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16377","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16377","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16377","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16379","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16379","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16379","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16381","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16381","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16381","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16383","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16383","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16383","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16387","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16387","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16387","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16390","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16390","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16390","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16391","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16391","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16391","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16396","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16396","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16396","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16405","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16405","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16405","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16412","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16412","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16412","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490799","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47104.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56208","tags":["advisory"]},{"url":"https://aomedia.googlesource.com/aom/+/243f8ae84b","tags":["article"]},{"url":"https://issues.chromium.org/issues/504317456","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47105.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2506217","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49621.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14899","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-14899","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49921.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_49922.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53444","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53444.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53445","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53445.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53446","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53446.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53453","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53453.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53454","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53454.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53455","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53455.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53475","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_53475.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54180","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54180.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54181","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54181.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54182","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54182.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54185","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54185.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54248","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54248.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54249","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54249.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54259","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54259.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54339","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54339.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47101","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47104","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:47105","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:49621","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:49921","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:49922","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623115-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269226","tags":["report"]},{"url":"https://bugzilla.suse.com/1271649","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12291","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12294","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12308","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12324","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12328","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16349","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16357","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16412","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623137-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263200-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263546-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14899","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-15719","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/#CVE-2026-15719","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-15719","title":"Site isolation issue in the DOM: Navigation component","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","status":"published","published":"2026-07-14T12:15:47.592Z","modified":"2026-07-22T19:19:22.168Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-43663","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","status":"published","published":"2026-07-14T12:15:47Z","modified":"2026-07-22T19:19:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:44.868793Z"}],"ghsa":[{"id":"GHSA-hqh9-m4jx-3x67","title":"We are aware that exploit code for this is public however we are not aware of any attacks in the...","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6.","status":"published","published":"2026-07-14T15:32:16Z","modified":"2026-07-22T21:32:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:09:40.63131Z"}],"nvd":[{"id":"CVE-2026-15719","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","status":"published","published":"2026-07-14T13:18:20.407Z","modified":"2026-07-22T20:16:48.927Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"DEBIAN-CVE-2026-15719","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","status":"published","published":"2026-07-14T13:18:20.407Z","modified":"2026-10-01T03:02:50.959193807Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"OESA-2026-3195","title":"thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nThe code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.(CVE-2026-14899)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:25.818897894Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3196","title":"thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\r\n\r\nSecurity Fix(es):\n\nThe code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.(CVE-2026-14899)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:04Z","modified":"2026-08-18T01:21:25.817247099Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3225","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:27.715719676Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3226","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:06Z","modified":"2026-08-18T01:21:26.051125497Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3227","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:06Z","modified":"2026-08-18T01:21:26.026286271Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3228","title":"firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo\r\n\r\nSecurity Fix(es):\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15718)\n\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-15719)\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16349)\n\nIncorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16350)\n\nSandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16351)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16352)\n\nInvalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16353)\n\nInformation disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16354)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16355)\n\nSandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16356)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16357)\n\nSite isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16358)\n\nIncorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16359)\n\nMemory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16360)\n\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.(CVE-2026-16361)\n\nUse-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16362)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16363)\n\nIncorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16368)\n\nInteger overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16369)\n\nPrivilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16371)\n\nInformation disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16374)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16375)\n\nMitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16377)\n\nPrivilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16379)\n\nSame-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16381)\n\nMitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16383)\n\nSite isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16387)\n\nMitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16390)\n\nInformation disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16391)\n\nPrivilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16396)\n\nInformation disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16405)\n\nMemory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.(CVE-2026-16412)","status":"published","published":"2026-08-01T11:12:06Z","modified":"2026-08-18T01:21:26.082344958Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:47101","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-07-29T10:11:37Z","modified":"2026-09-09T10:32:16.85688327Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47104","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-04T10:25:45Z","modified":"2026-10-20T10:09:49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:47105","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-07-29T10:11:38Z","modified":"2026-10-20T10:09:50Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49621","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-04T10:26:54Z","modified":"2026-09-09T10:32:12.383059162Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49921","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-05T10:37:21Z","modified":"2026-09-09T10:32:14.128660354Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:49922","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-05T10:37:22Z","modified":"2026-09-09T10:32:14.415028437Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RHSA-2026:53444","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:30Z","modified":"2026-09-09T10:32:26.74943328Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53445","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:31Z","modified":"2026-09-09T10:32:26.763650541Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53446","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:31Z","modified":"2026-09-09T10:32:18.634283641Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53453","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:33Z","modified":"2026-09-09T10:32:18.747599894Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53454","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:34Z","modified":"2026-09-09T10:32:18.669691858Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53455","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:34Z","modified":"2026-09-09T10:32:18.699694755Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:53475","title":"Red Hat Security Advisory: thunderbird security update","status":"published","published":"2026-08-12T10:16:35Z","modified":"2026-09-09T10:32:18.777749383Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54180","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-12T10:16:44Z","modified":"2026-10-20T10:10:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54181","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-12T10:16:45Z","modified":"2026-10-20T10:10:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54182","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-12T10:16:46Z","modified":"2026-10-20T10:10:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54185","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-12T10:16:47Z","modified":"2026-10-20T10:10:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54248","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-13T10:17:37Z","modified":"2026-10-20T10:11:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54249","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-13T10:17:38Z","modified":"2026-10-20T10:11:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54259","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-13T10:17:39Z","modified":"2026-10-20T10:11:02Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54339","title":"Red Hat Security Advisory: firefox security update","status":"published","published":"2026-08-13T10:17:42Z","modified":"2026-10-20T10:11:03Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:47101","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-30T12:06:30.380063Z","modified":"2026-07-30T12:30:06.841874287Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47104","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-03T12:03:50.556944Z","modified":"2026-08-03T12:30:05.519185251Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:47105","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-07-29T18:01:13.110756Z","modified":"2026-07-29T18:25:49.310735256Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:49621","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n* thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-06T00:07:16.929494Z","modified":"2026-08-06T00:30:06.4695582Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:49921","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n* thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-06T00:04:20.676095Z","modified":"2026-08-06T00:30:07.848075351Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:49922","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n* thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-06T00:01:21.490484Z","modified":"2026-08-06T00:30:06.515154504Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-15719","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.","status":"published","published":"2026-07-14T13:18:00Z","modified":"2026-07-29T10:18:17.982945964Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:47101","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:30:32.335376941Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47104","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:32:24.085955121Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:47105","title":"Important: firefox security update","description":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.  \n\nSecurity Fix(es):  \n\n  * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-10-29T11:02:24.759693867Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:49621","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-03T00:00:00Z","modified":"2026-10-29T11:30:38.455507991Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:49921","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-04T00:00:00Z","modified":"2026-10-29T11:32:23.472768054Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:49922","title":"Important: thunderbird security update","description":"Mozilla Thunderbird is a standalone mail and newsgroup client.  \n\nSecurity Fix(es):  \n\n  * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n  * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n  * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n  * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n  * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n  * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n  * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n  * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n  * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n  * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n  * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n  * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n  * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n  * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n  * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n  * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n  * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n  * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n  * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n  * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n  * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n  * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n  * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n  * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n  * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n  * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n  * thunderbird: Off-by-one out of bounds read in MIME header parser for forwarding (CVE-2026-14899)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-04T00:00:00Z","modified":"2026-10-29T11:02:24.853107711Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"CLSA-2026-1785839724","title":"thunderbird: Fix of 35 CVEs","description":"- update to 140.13.0 ESR (MFSA 2026-72; includes MFSA 2026-64 / 140.12.1 fixes)\n- CVE-2026-14899: The code to parse MIME headers for display when forwarding\n  a message (if the setting to view all headers was enabled) had an\n  off-by-one error, allowing a single byte to be read from the memory after\n  the buffer for the headers, and potentially crashing Thunderbird\n- CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component.\n  Exploit code for this issue is public\n- CVE-2026-15719: Site isolation issue in the DOM: Navigation component.\n  Exploit code for this issue is public\n- CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component\n- CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb\n  component\n- CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation\n  component\n- CVE-2026-16352: Sandbox escape due to use-after-free in the Disability\n  Access APIs component\n- CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component\n- CVE-2026-16354: Information disclosure in the Graphics: ImageLib component\n- CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component\n- CVE-2026-16356: Sandbox escape due to use-after-free in the Disability\n  Access APIs component\n- CVE-2026-16357: Incorrect boundary conditions in the Graphics component\n- CVE-2026-16358: Site isolation issue in the Graphics: WebRender component\n- CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP\n  component\n- CVE-2026-16360: Memory safety bugs present in Thunderbird ESR 140.12 and\n  Thunderbird 152. Some of these bugs showed evidence of memory corruption\n  and we presume that with enough effort some of these could have been\n  exploited to run arbitrary code\n- CVE-2026-16361: Memory safety bugs present in Thunderbird ESR 140.12. Some\n  of these bugs showed evidence of memory corruption and we presume that with\n  enough effort some of these could have been exploited to run arbitrary code\n- CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component\n- CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component\n- CVE-2026-16368: Incorrect boundary conditions in the JavaScript:\n  WebAssembly component\n- CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component\n- CVE-2026-16371: Privilege escalation in the DOM: Navigation component\n- CVE-2026-16374: Information disclosure in the Framework component in\n  DevTools\n- CVE-2026-16375: Site isolation issue in the Networking: HTTP component\n- CVE-2026-16377: Mitigation bypass in the PDF Viewer component\n- CVE-2026-16379: Privilege escalation in the DOM: Content Processes\n  component\n- CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component\n- CVE-2026-16383: Mitigation bypass in the DOM: Networking component\n- CVE-2026-16387: Site isolation issue in the Networking component\n- CVE-2026-16390: Mitigation bypass in the Enterprise Policies component\n- CVE-2026-16391: Information disclosure in the Storage: IndexedDB component\n- CVE-2026-16396: Privilege escalation in WebExtensions\n- CVE-2026-16405: Information disclosure in the Networking: WebSockets\n  component\n- CVE-2026-16412: Memory safety bugs present in Thunderbird ESR 140.12 and\n  Thunderbird 152. Some of these bugs showed evidence of memory corruption\n  and we presume that with enough effort some of these could have been\n  exploited to run arbitrary code\n- CVE-2026-57962: Memory exhaustion via a malicious LDAP address-book server\n- CVE-2026-57963: Content injection via HTML chat messages (Matrix/XMPP)","status":"published","published":"2026-08-04T10:36:04Z","modified":"2026-10-26T09:30:31.215417939Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"MGASA-2026-0325","title":"Updated rootcerts, nss \u0026 firefox packages fix security vulnerabilities","description":"Updated rootcerts, nss \u0026 firefox packages fixes various vulnerabilities.\nPlease see the links for detailed information of each one.\n","status":"published","published":"2026-08-07T06:29:31Z","modified":"2026-08-07T06:30:05.510435059Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"MGASA-2026-0326","title":"Updated thunderbird packages fix security vulnerabilities","description":"Updated thunderbird packages fix various security issues. See the\nlinks to get complete information of each issue.\n","status":"published","published":"2026-08-07T06:29:31Z","modified":"2026-08-07T06:43:39.988048418Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11311-1","title":"MozillaFirefox-152.0.6-1.1 on GA media","description":"These are all security issues fixed in the MozillaFirefox-152.0.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-20T00:00:00Z","modified":"2026-07-21T09:45:08.132553719Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11329-1","title":"firefox-esr-140.13.0-1.1 on GA media","description":"These are all security issues fixed in the firefox-esr-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-22T00:00:00Z","modified":"2026-07-23T09:45:08.289528918Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11359-1","title":"MozillaThunderbird-140.13.0-1.1 on GA media","description":"These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-24T00:00:00Z","modified":"2026-07-25T18:24:56.596415934Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21519-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\n- Update to Firefox Extended Support Release 140.13.0 ESR.\n  - MFSA 2026-70 (bsc#1271649):\n    * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component\n    * CVE-2026-15719: Site isolation issue in the DOM: Navigation component\n    * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component\n    * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component\n    * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component\n    * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component\n    * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component\n    * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component\n    * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component\n    * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component\n    * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component\n    * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component\n    * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16357: Incorrect boundary conditions in the Graphics component\n    * CVE-2026-16371: Privilege escalation in the DOM: Navigation component\n    * CVE-2026-16374: Information disclosure in the Framework component in DevTools\n    * CVE-2026-16375: Site isolation issue in the Networking: HTTP component\n    * CVE-2026-16377: Mitigation bypass in the PDF Viewer component\n    * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component\n    * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component\n    * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component\n    * CVE-2026-16383: Mitigation bypass in the DOM: Networking component\n    * CVE-2026-16387: Site isolation issue in the Networking component\n    * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component\n    * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component\n    * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component\n    * CVE-2026-16396: Privilege escalation in WebExtensions\n    * CVE-2026-16405: Information disclosure in the Networking: WebSockets component\n    * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13\n- Remove obsolete `mozilla-nss-certs` (bsc#1269226).\n","status":"published","published":"2026-08-03T17:09:17Z","modified":"2026-08-04T18:30:06.535416897Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:23115-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\n- Update to Firefox Extended Support Release 140.13.0 ESR.\n  - MFSA 2026-70 (bsc#1271649):\n    * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component\n    * CVE-2026-15719: Site isolation issue in the DOM: Navigation component\n    * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component\n    * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component\n    * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component\n    * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component\n    * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component\n    * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component\n    * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component\n    * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component\n    * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component\n    * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component\n    * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16357: Incorrect boundary conditions in the Graphics component\n    * CVE-2026-16371: Privilege escalation in the DOM: Navigation component\n    * CVE-2026-16374: Information disclosure in the Framework component in DevTools\n    * CVE-2026-16375: Site isolation issue in the Networking: HTTP component\n    * CVE-2026-16377: Mitigation bypass in the PDF Viewer component\n    * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component\n    * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component\n    * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component\n    * CVE-2026-16383: Mitigation bypass in the DOM: Networking component\n    * CVE-2026-16387: Site isolation issue in the Networking component\n    * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component\n    * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component\n    * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component\n    * CVE-2026-16396: Privilege escalation in WebExtensions\n    * CVE-2026-16405: Information disclosure in the Networking: WebSockets component\n    * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13\n- Remove obsolete `mozilla-nss-certs` (bsc#1269226).\n","status":"published","published":"2026-08-03T18:05:15Z","modified":"2026-08-14T18:23:39.763004949Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23137-1","title":"Security update for MozillaFirefox","description":"This update for MozillaFirefox fixes the following issues:\n\n- Update to Firefox Extended Support Release 140.13.0 ESR.\n  - MFSA 2026-70 (bsc#1271649):\n    * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component\n    * CVE-2026-15719: Site isolation issue in the DOM: Navigation component\n    * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component\n    * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb component\n    * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component\n    * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation component\n    * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component\n    * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component\n    * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component\n    * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly component\n    * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component\n    * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component\n    * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability Access APIs component\n    * CVE-2026-16357: Incorrect boundary conditions in the Graphics component\n    * CVE-2026-16371: Privilege escalation in the DOM: Navigation component\n    * CVE-2026-16374: Information disclosure in the Framework component in DevTools\n    * CVE-2026-16375: Site isolation issue in the Networking: HTTP component\n    * CVE-2026-16377: Mitigation bypass in the PDF Viewer component\n    * CVE-2026-16379: Privilege escalation in the DOM: Content Processes component\n    * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component\n    * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component\n    * CVE-2026-16383: Mitigation bypass in the DOM: Networking component\n    * CVE-2026-16387: Site isolation issue in the Networking component\n    * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component\n    * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component\n    * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP component\n    * CVE-2026-16396: Privilege escalation in WebExtensions\n    * CVE-2026-16405: Information disclosure in the Networking: WebSockets component\n    * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153\n    * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13\n- Remove obsolete `mozilla-nss-certs` (bsc#1269226).\n","status":"published","published":"2026-08-03T18:05:15Z","modified":"2026-08-14T18:23:41.078478278Z","updated_at":"2026-11-02T15:54:03.503431Z"}]},"sources_more":{"osv":3}}