SUSE-SU-2026:4545-1

Severidad por fuente

Ninguna fuente da una puntuación CVSS.

La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.

Descripción

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.4.0 ESR (MFSA 2026-100, bsc#1282929): - CVE-2026-96869: Information disclosure in the Networking component. - CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component. - CVE-2026-100757: Use-after-free in the Widget component. - CVE-2026-100758: Sandbox escape in the DOM: Navigation component. - CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component. - CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component. - CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component. - CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100766: Information disclosure in the Networking: JAR component. - CVE-2026-100767: Use-after-free in the Networking: Cache component. - CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component. - CVE-2026-100771: Undefined behavior in the DOM: Streams component. - CVE-2026-100772: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100773: Use-after-free in the Storage: IndexedDB component. - CVE-2026-100774: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100775: Sandbox escape in the Graphics component. - CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component. - CVE-2026-100779: Use-after-free in the XSLT component. - CVE-2026-100780: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. - CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component. - CVE-2026-100783: Uninitialized memory in the Audio/Video component. - CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-100785: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component. - CVE-2026-100787: Sandbox escape in the XUL component. - CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component. - CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component. - CVE-2026-100790: Use-after-free in the XSLT component. - CVE-2026-100791: Use-after-free in the DOM: Core & HTML component. - CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component. - CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component. - CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component. - CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component. - CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component. - CVE-2026-100801: Privilege escalation in the DLL Services component. - CVE-2026-100803: Same-origin policy bypass in the WebExtensions component. - CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component. - CVE-2026-100807: Privilege escalation in the DOM: Service Workers component. - CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component. - CVE-2026-100809: Same-origin policy bypass in the DevTools component. - CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component. - CVE-2026-100812: Denial-of-service in the Graphics component. - CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component. - CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component. - CVE-2026-100816: Site isolation issue in the DOM: Networking component. - CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component. - CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component. - CVE-2026-100820: Privilege escalation in the Address Bar component. - CVE-2026-100821: Site isolation issue in the Panning and Zooming component. - CVE-2026-100822: Spoofing issue in the Networking: HTTP component. - CVE-2026-100824: Privilege escalation in the Places component. - CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component. - CVE-2026-100826: Denial-of-service in the Storage: StorageManager component. - CVE-2026-100828: Mitigation bypass in the Bookmarks & History component. - CVE-2026-100829: Mitigation bypass in the DOM: Security component. - CVE-2026-100830: Mitigation bypass in the DOM: Navigation component. - CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component. - CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.

Paquetes afectados y versiones corregidas

Referencias

• https://bugzilla.suse.com/1282929
• https://www.suse.com/security/cve/CVE-2026-100756/
• https://www.suse.com/security/cve/CVE-2026-100757/
• https://www.suse.com/security/cve/CVE-2026-100758/
• https://www.suse.com/security/cve/CVE-2026-100759/
• https://www.suse.com/security/cve/CVE-2026-100760/
• https://www.suse.com/security/cve/CVE-2026-100762/
• https://www.suse.com/security/cve/CVE-2026-100765/