SUSE-SU-2026:3683-1: MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:3683-1 is a vulnerability in MozillaFirefox&distro=SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 21-08-2026
   PublishedVulnerability first disclosed.
2. 26-08-2026
   Last modifiedVulnerability information updated.

Description

Security update for MozillaFirefox This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-74 (bsc#1274867): - CVE-2026-74934: Site isolation issue in the Graphics: CanvasWebGL component. - CVE-2026-74935: Privilege escalation in the DOM: Networking component. - CVE-2026-74936: Use-after-free in the JavaScript: WebAssembly component. - CVE-2026-74937: Use-after-free in the JavaScript: GC component. - CVE-2026-74938: Mitigation bypass in the JavaScript: GC component. - CVE-2026-74939: Privilege escalation in the DOM: Navigation component. - CVE-2026-74940: Use-after-free in the Graphics: Text component. - CVE-2026-74941: Privilege escalation in the Graphics: CanvasWebGL component. - CVE-2026-74942: Privilege escalation in the Remote Settings Client component. - CVE-2026-74943: Use-after-free in the Graphics: ImageLib component. - CVE-2026-74944: Use-after-free in the DOM: Core & HTML component. - CVE-2026-74945: Information disclosure in the Graphics: Text component. - CVE-2026-74946: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. - CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component. - CVE-2026-74948: Information disclosure in the Graphics component. - CVE-2026-74949: Privilege escalation due to use-after-free in the Graphics: Canvas2D component. - CVE-2026-74950: Privilege escalation in the Downloads API component. - CVE-2026-74951: Clickjacking issue in Firefox for Android. - CVE-2026-74952: Privilege escalation in the Application Update component. - CVE-2026-74953: Privilege escalation in the Networking: Cookies component. - CVE-2026-74954: Information disclosure due to side-channel in the Storage: Cache API component. - CVE-2026-74955: Privilege escalation in the Request Handling component. - CVE-2026-74956: Same-origin policy bypass in the DOM: Service Workers component. - CVE-2026-74957: Mitigation bypass in the Safe Browsing component. - CVE-2026-74958: Information disclosure in the WebRTC component. - CVE-2026-74959: Mitigation bypass in the Storage: Cache API component. - CVE-2026-74960: Site isolation issue in the WebExtensions component. - CVE-2026-74961: Side-channel in the Web Audio component. - CVE-2026-74962: Site isolation issue in the Networking: Cookies component. - CVE-2026-74963: Same-origin policy bypass in the Networking: Cookies component. - CVE-2026-74964: Integer overflow in the Graphics component. - CVE-2026-74965: Privilege escalation in the Shell Integration component. - CVE-2026-74966: Information disclosure in the Form Autofill component. - CVE-2026-74967: Same-origin policy bypass in the Audio/Video: Playback component. - CVE-2026-74968: Site isolation issue in the Graphics: WebRender component. - CVE-2026-74969: Use-after-free in the Layout: Text and Fonts component. - CVE-2026-74970: Site isolation issue in the Graphics component. - CVE-2026-74971: Information disclosure in the DOM: UI Events & Focus Handling component. - CVE-2026-74972: Information disclosure in the DOM: Push Subscriptions component. - CVE-2026-74973: Race condition, use-after-free in the Graphics component. - CVE-2026-74974: Same-origin policy bypass in the Graphics: ImageLib component. - CVE-2026-74975: Spoofing issue in the Downloads component in Firefox for Android. - CVE-2026-74976: JIT miscompilation in the JavaScript Engine: JIT component. - CVE-2026-74977: Integer overflow in the Graphics component. - CVE-2026-74978: Clickjacking issue in the Widget component. - CVE-2026-74979: Mitigation bypass in the Add-ons Manager component. - CVE-2026-74980: Clickjacking issue in the Downloads component in Firefox for Android. - CVE-2026-74981: Site isolation issue in the Audio/Video: Web Codecs component. - CVE-2026-74982: Denial-of-service in the Widget component. - CVE-2026-74983: Mitigation bypass in the Data Loss Prevention component. - CVE-2026-74984: Race condition in the JavaScript Engine component. - CVE-2026-74985: Privilege escalation in the Enterprise Policies component. - CVE-2026-74986: Site isolation issue in the CSS Parsing and Computation component. - CVE-2026-74987: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154. - CVE-2026-74988: Internally found bugs fixed in Firefox ESR 153.1 and Firefox 154. - CVE-2026-74989: Internally found bugs fixed in Firefox 154. - CVE-2026-74990: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154. - CVE-2026-75874: Sandbox escape in the Remote Settings Client component.

No weakness data has been published for this record.