Security update for MozillaFirefox
| Announcement ID: | SUSE-SU-2026:1127-1 |
|---|---|
| Release Date: | 2026-03-27T14:43:08Z |
| Rating: | important |
| References: | |
| Cross-References: |
|
| CVSS scores: |
|
| Affected Products: |
|
An update that solves 38 vulnerabilities can now be installed.
Description:
This update for MozillaFirefox fixes the following issues:
Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083):
- CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
- CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
- CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
- CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
- CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
- CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
- CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component
- CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component
- CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
- CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component
- CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
- CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
- CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
- CVE-2026-4701: Use-after-free in the JavaScript Engine component
- CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
- CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
- CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
- CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component
- CVE-2026-4708: Incorrect boundary conditions in the Graphics component
- CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
- CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
- CVE-2026-4711: Use-after-free in the Widget: Cocoa component
- CVE-2026-4712: Information disclosure in the Widget: Cocoa component
- CVE-2026-4713: Incorrect boundary conditions in the Graphics component
- CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
- CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
- CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
- CVE-2026-4717: Privilege escalation in the Netmonitor component
- CVE-2025-59375: Denial-of-service in the XML component
- CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
- CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component
- CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
- CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-1127=1 -
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-1127=1
Package List:
-
SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
- MozillaFirefox-debugsource-140.9.0-112.304.2
- MozillaFirefox-translations-common-140.9.0-112.304.2
- MozillaFirefox-debuginfo-140.9.0-112.304.2
- MozillaFirefox-140.9.0-112.304.2
-
SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
- MozillaFirefox-devel-140.9.0-112.304.2
-
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
- MozillaFirefox-debugsource-140.9.0-112.304.2
- MozillaFirefox-translations-common-140.9.0-112.304.2
- MozillaFirefox-debuginfo-140.9.0-112.304.2
- MozillaFirefox-140.9.0-112.304.2
-
SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
- MozillaFirefox-devel-140.9.0-112.304.2
References:
- https://www.suse.com/security/cve/CVE-2025-59375.html
- https://www.suse.com/security/cve/CVE-2026-4684.html
- https://www.suse.com/security/cve/CVE-2026-4685.html
- https://www.suse.com/security/cve/CVE-2026-4686.html
- https://www.suse.com/security/cve/CVE-2026-4687.html
- https://www.suse.com/security/cve/CVE-2026-4688.html
- https://www.suse.com/security/cve/CVE-2026-4689.html
- https://www.suse.com/security/cve/CVE-2026-4690.html
- https://www.suse.com/security/cve/CVE-2026-4691.html
- https://www.suse.com/security/cve/CVE-2026-4692.html
- https://www.suse.com/security/cve/CVE-2026-4693.html
- https://www.suse.com/security/cve/CVE-2026-4694.html
- https://www.suse.com/security/cve/CVE-2026-4695.html
- https://www.suse.com/security/cve/CVE-2026-4696.html
- https://www.suse.com/security/cve/CVE-2026-4697.html
- https://www.suse.com/security/cve/CVE-2026-4698.html
- https://www.suse.com/security/cve/CVE-2026-4699.html
- https://www.suse.com/security/cve/CVE-2026-4700.html
- https://www.suse.com/security/cve/CVE-2026-4701.html
- https://www.suse.com/security/cve/CVE-2026-4702.html
- https://www.suse.com/security/cve/CVE-2026-4704.html
- https://www.suse.com/security/cve/CVE-2026-4705.html
- https://www.suse.com/security/cve/CVE-2026-4706.html
- https://www.suse.com/security/cve/CVE-2026-4707.html
- https://www.suse.com/security/cve/CVE-2026-4708.html
- https://www.suse.com/security/cve/CVE-2026-4709.html
- https://www.suse.com/security/cve/CVE-2026-4710.html
- https://www.suse.com/security/cve/CVE-2026-4711.html
- https://www.suse.com/security/cve/CVE-2026-4712.html
- https://www.suse.com/security/cve/CVE-2026-4713.html
- https://www.suse.com/security/cve/CVE-2026-4714.html
- https://www.suse.com/security/cve/CVE-2026-4715.html
- https://www.suse.com/security/cve/CVE-2026-4716.html
- https://www.suse.com/security/cve/CVE-2026-4717.html
- https://www.suse.com/security/cve/CVE-2026-4718.html
- https://www.suse.com/security/cve/CVE-2026-4719.html
- https://www.suse.com/security/cve/CVE-2026-4720.html
- https://www.suse.com/security/cve/CVE-2026-4721.html
- https://bugzilla.suse.com/show_bug.cgi?id=1260083