Security update for MozillaFirefox
| Announcement ID: | SUSE-SU-2026:1126-1 |
|---|---|
| Release Date: | 2026-03-27T14:42:48Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 38 vulnerabilities can now be installed.
Description:
This update for MozillaFirefox fixes the following issues:
Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083):
- CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
- CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
- CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
- CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
- CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component
- CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component
- CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
- CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component
- CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
- CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
- CVE-2026-4701: Use-after-free in the JavaScript Engine component
- CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
- CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
- CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
- CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4708: Incorrect boundary conditions in the Graphics component
- CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
- CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
- CVE-2026-4711: Use-after-free in the Widget: Cocoa component
- CVE-2026-4712: Information disclosure in the Widget: Cocoa component
- CVE-2026-4713: Incorrect boundary conditions in the Graphics component
- CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
- CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
- CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
- CVE-2026-4717: Privilege escalation in the Netmonitor component
- CVE-2025-59375: Denial-of-service in the XML component
- CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
- CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component
- CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
openSUSE Leap 15.6
zypper in -t patch openSUSE-SLE-15.6-2026-1126=1 -
Desktop Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Desktop-Applications-15-SP7-2026-1126=1 -
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1126=1 -
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1126=1 -
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1126=1 -
SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1126=1 -
SUSE Linux Enterprise Server 15 SP4 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1126=1 -
SUSE Linux Enterprise Server 15 SP5 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1126=1 -
SUSE Linux Enterprise Server 15 SP6 LTSS
zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1126=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP4
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1126=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP5
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1126=1 -
SUSE Linux Enterprise Server for SAP Applications 15 SP6
zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1126=1
Package List:
-
openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-branding-upstream-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
openSUSE Leap 15.6 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
Desktop Applications Module 15-SP7 (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
Desktop Applications Module 15-SP7 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64 x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP4 LTSS (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP5 LTSS (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server 15 SP6 LTSS (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
- MozillaFirefox-debuginfo-140.9.0-150200.152.225.1
- MozillaFirefox-translations-other-140.9.0-150200.152.225.1
- MozillaFirefox-140.9.0-150200.152.225.1
- MozillaFirefox-translations-common-140.9.0-150200.152.225.1
- MozillaFirefox-debugsource-140.9.0-150200.152.225.1
-
SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch)
- MozillaFirefox-devel-140.9.0-150200.152.225.1
References:
- https://www.suse.com/security/cve/CVE-2025-59375.html
- https://www.suse.com/security/cve/CVE-2026-4684.html
- https://www.suse.com/security/cve/CVE-2026-4685.html
- https://www.suse.com/security/cve/CVE-2026-4686.html
- https://www.suse.com/security/cve/CVE-2026-4687.html
- https://www.suse.com/security/cve/CVE-2026-4688.html
- https://www.suse.com/security/cve/CVE-2026-4689.html
- https://www.suse.com/security/cve/CVE-2026-4690.html
- https://www.suse.com/security/cve/CVE-2026-4691.html
- https://www.suse.com/security/cve/CVE-2026-4692.html
- https://www.suse.com/security/cve/CVE-2026-4693.html
- https://www.suse.com/security/cve/CVE-2026-4694.html
- https://www.suse.com/security/cve/CVE-2026-4695.html
- https://www.suse.com/security/cve/CVE-2026-4696.html
- https://www.suse.com/security/cve/CVE-2026-4697.html
- https://www.suse.com/security/cve/CVE-2026-4698.html
- https://www.suse.com/security/cve/CVE-2026-4699.html
- https://www.suse.com/security/cve/CVE-2026-4700.html
- https://www.suse.com/security/cve/CVE-2026-4701.html
- https://www.suse.com/security/cve/CVE-2026-4702.html
- https://www.suse.com/security/cve/CVE-2026-4704.html
- https://www.suse.com/security/cve/CVE-2026-4705.html
- https://www.suse.com/security/cve/CVE-2026-4706.html
- https://www.suse.com/security/cve/CVE-2026-4707.html
- https://www.suse.com/security/cve/CVE-2026-4708.html
- https://www.suse.com/security/cve/CVE-2026-4709.html
- https://www.suse.com/security/cve/CVE-2026-4710.html
- https://www.suse.com/security/cve/CVE-2026-4711.html
- https://www.suse.com/security/cve/CVE-2026-4712.html
- https://www.suse.com/security/cve/CVE-2026-4713.html
- https://www.suse.com/security/cve/CVE-2026-4714.html
- https://www.suse.com/security/cve/CVE-2026-4715.html
- https://www.suse.com/security/cve/CVE-2026-4716.html
- https://www.suse.com/security/cve/CVE-2026-4717.html
- https://www.suse.com/security/cve/CVE-2026-4718.html
- https://www.suse.com/security/cve/CVE-2026-4719.html
- https://www.suse.com/security/cve/CVE-2026-4720.html
- https://www.suse.com/security/cve/CVE-2026-4721.html
- https://bugzilla.suse.com/show_bug.cgi?id=1260083