SUSE alert SUSE-SU-2026:23918-1 (firefox)
| From: | SLE-SECURITY-UPDATES <null@suse.de> | |
| To: | sle-security-updates@lists.suse.com | |
| Subject: | SUSE-SU-2026:23918-1: important: Security update for MozillaFirefox | |
| Date: | Tue, 29 Sep 2026 20:32:30 -0000 | |
| Message-ID: | <179071395080.30144.17317512009077447420@af273d3f1972> |
# Security update for MozillaFirefox Announcement ID: SUSE-SU-2026:23918-1 Release Date: 2026-09-24T13:20:47Z Rating: important References: * bsc#1280371 Cross-References: * CVE-2026-92005 * CVE-2026-92006 * CVE-2026-92007 * CVE-2026-92008 * CVE-2026-92009 * CVE-2026-92010 * CVE-2026-92011 * CVE-2026-92012 * CVE-2026-92013 * CVE-2026-92015 * CVE-2026-92016 * CVE-2026-92017 * CVE-2026-92018 * CVE-2026-92019 * CVE-2026-92020 * CVE-2026-92022 * CVE-2026-92023 * CVE-2026-92024 * CVE-2026-92025 * CVE-2026-92026 * CVE-2026-92027 * CVE-2026-92028 * CVE-2026-92029 * CVE-2026-92030 * CVE-2026-92031 * CVE-2026-92032 * CVE-2026-92035 * CVE-2026-92038 * CVE-2026-92039 * CVE-2026-92041 * CVE-2026-92042 * CVE-2026-92043 * CVE-2026-92044 * CVE-2026-92045 * CVE-2026-92046 * CVE-2026-92047 * CVE-2026-92048 * CVE-2026-92049 * CVE-2026-92052 * CVE-2026-92053 * CVE-2026-92054 * CVE-2026-92055 * CVE-2026-92056 * CVE-2026-92057 * CVE-2026-92058 * CVE-2026-92059 * CVE-2026-92060 * CVE-2026-92062 * CVE-2026-92064 * CVE-2026-92065 * CVE-2026-92067 * CVE-2026-92068 * CVE-2026-92069 * CVE-2026-92070 * CVE-2026-92071 * CVE-2026-92072 * CVE-2026-92073 * CVE-2026-92074 * CVE-2026-92075 * CVE-2026-92076 * CVE-2026-92077 * CVE-2026-92078 * CVE-2026-92079 CVSS scores: * CVE-2026-92005 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L * CVE-2026-92006 ( SUSE ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92006 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92007 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92008 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92009 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92010 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92011 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92012 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92013 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92015 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92016 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92017 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92018 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92019 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N * CVE-2026-92020 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92022 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92023 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92024 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92025 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92026 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92027 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92028 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92029 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92030 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-92031 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N * CVE-2026-92032 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92035 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92038 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-92039 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2026-92041 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-92042 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92043 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92044 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N * CVE-2026-92045 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92046 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92047 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92048 ( NVD ): 9.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92049 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92052 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92053 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92054 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92055 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92056 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92057 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-92058 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92059 ( NVD ): 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H * CVE-2026-92060 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92062 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92064 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2026-92065 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2026-92067 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92068 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N * CVE-2026-92069 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L * CVE-2026-92070 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-92071 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H * CVE-2026-92072 ( NVD ): 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92073 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2026-92074 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2026-92075 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-92076 ( NVD ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H * CVE-2026-92077 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-92078 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2026-92079 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * SUSE Linux Enterprise Server 16.0 * SUSE Linux Enterprise Server for SAP applications 16.0 An update that solves 63 vulnerabilities can now be installed. ## Description: This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.3.0 ESR (MFSA 2026-93, bsc#1280371): * CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component. * CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. * CVE-2026-92015: Privilege escalation in the WebExtensions component. * CVE-2026-92016: Use-after-free in the Disability Access APIs component. * CVE-2026-92017: Privilege escalation in the DOM: Service Workers component. * CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component. * CVE-2026-92019: Mitigation bypass in the Remote Settings Client component. * CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. * CVE-2026-92022: Use-after-free in the DOM: HTML Parser component. * CVE-2026-92023: Use-after-free in the XML component. * CVE-2026-92024: Use-after-free in the SVG component. * CVE-2026-92025: Use-after-free in the DOM: Navigation component. * CVE-2026-92026: Use-after-free in the Networking component. * CVE-2026-92027: Use-after-free in the DOM: Streams component. * CVE-2026-92028: Use-after-free in the DOM: Core & HTML component. * CVE-2026-92029: Use-after-free in the SVG component. * CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. * CVE-2026-92031: Information disclosure in the Graphics: ImageLib component. * CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component. * CVE-2026-92035: Sandbox escape due to incorrect boundary conditions in the Graphics component. * CVE-2026-92038: Mitigation bypass in the Remote Settings Client component. * CVE-2026-92039: Mitigation bypass in the DOM: Notifications component. * CVE-2026-92041: Mitigation bypass in the DOM: Networking component. * CVE-2026-92042: Race condition in the DOM: Content Processes component. * CVE-2026-92043: Privilege escalation due to incorrect boundary conditions in the Audio/Video component. * CVE-2026-92044: Information disclosure in the Networking: HTTP component. * CVE-2026-92045: Sandbox escape due to incorrect boundary conditions in the WebRTC component. * CVE-2026-92046: Use-after-free in the Graphics component. * CVE-2026-92047: Privilege escalation in the Crash Reporting component. * CVE-2026-92048: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. * CVE-2026-92049: Use-after-free in the Widget: Win32 component. * CVE-2026-92052: Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. * CVE-2026-92053: Privilege escalation in the Graphics: CanvasWebGL component. * CVE-2026-92054: Privilege escalation in the Memory component. * CVE-2026-92055: Privilege escalation in the DevTools component. * CVE-2026-92056: Use-after-free in the Graphics: Text component. * CVE-2026-92057: Mitigation bypass in the Enterprise Policies component. * CVE-2026-92058: Use-after-free in the Graphics component. * CVE-2026-92059: Incorrect boundary conditions in the DOM: Editor component. * CVE-2026-92060: Use-after-free in the Internationalization component. * CVE-2026-92062: Privilege escalation in the Session Restore component. * CVE-2026-92064: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. * CVE-2026-92065: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. * CVE-2026-92067: Use-after-free in the Widget: Gtk component. * CVE-2026-92068: Site isolation issue in the Reader Mode component. * CVE-2026-92069: Spoofing issue in the DOM: Navigation component. * CVE-2026-92070: Information disclosure in the Networking component. * CVE-2026-92071: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. * CVE-2026-92072: Incorrect boundary conditions in the Safe Browsing component. * CVE-2026-92073: Privilege escalation in the Enterprise Policies component. * CVE-2026-92074: Mitigation bypass in the Popup Blocker component. * CVE-2026-92075: Mitigation bypass in the Networking component. * CVE-2026-92076: Incorrect boundary conditions in the Networking component. * CVE-2026-92077: Denial-of-service in the SVG component. * CVE-2026-92078: Denial-of-service in the Security component. * CVE-2026-92079: Mitigation bypass in the Widget: Win32 component. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server for SAP applications 16.0 zypper in -t patch SUSE-SLES-16.0-1760 * SUSE Linux Enterprise Server 16.0 zypper in -t patch SUSE-SLES-16.0-1760 ## Package List: * SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64) * MozillaFirefox-153.3.0-160000.1.1 * MozillaFirefox-translations-common-153.3.0-160000.1.1 * MozillaFirefox-debuginfo-153.3.0-160000.1.1 * MozillaFirefox-debugsource-153.3.0-160000.1.1 * MozillaFirefox-translations-other-153.3.0-160000.1.1 * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch) * MozillaFirefox-devel-153.3.0-160000.1.1 * SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le x86_64) * MozillaFirefox-153.3.0-160000.1.1 * MozillaFirefox-translations-common-153.3.0-160000.1.1 * MozillaFirefox-debuginfo-153.3.0-160000.1.1 * MozillaFirefox-debugsource-153.3.0-160000.1.1 * MozillaFirefox-translations-other-153.3.0-160000.1.1 * SUSE Linux Enterprise Server 16.0 (noarch) * MozillaFirefox-devel-153.3.0-160000.1.1 ## References: * https://www.suse.com/security/cve/CVE-2026-92005.html * https://www.suse.com/security/cve/CVE-2026-92006.html * https://www.suse.com/security/cve/CVE-2026-92007.html * https://www.suse.com/security/cve/CVE-2026-92008.html * https://www.suse.com/security/cve/CVE-2026-92009.html * https://www.suse.com/security/cve/CVE-2026-92010.html * https://www.suse.com/security/cve/CVE-2026-92011.html * https://www.suse.com/security/cve/CVE-2026-92012.html * https://www.suse.com/security/cve/CVE-2026-92013.html * https://www.suse.com/security/cve/CVE-2026-92015.html * https://www.suse.com/security/cve/CVE-2026-92016.html * https://www.suse.com/security/cve/CVE-2026-92017.html * https://www.suse.com/security/cve/CVE-2026-92018.html * https://www.suse.com/security/cve/CVE-2026-92019.html * https://www.suse.com/security/cve/CVE-2026-92020.html * https://www.suse.com/security/cve/CVE-2026-92022.html * https://www.suse.com/security/cve/CVE-2026-92023.html * https://www.suse.com/security/cve/CVE-2026-92024.html * https://www.suse.com/security/cve/CVE-2026-92025.html * https://www.suse.com/security/cve/CVE-2026-92026.html * https://www.suse.com/security/cve/CVE-2026-92027.html * https://www.suse.com/security/cve/CVE-2026-92028.html * https://www.suse.com/security/cve/CVE-2026-92029.html * https://www.suse.com/security/cve/CVE-2026-92030.html * https://www.suse.com/security/cve/CVE-2026-92031.html * https://www.suse.com/security/cve/CVE-2026-92032.html * https://www.suse.com/security/cve/CVE-2026-92035.html * https://www.suse.com/security/cve/CVE-2026-92038.html * https://www.suse.com/security/cve/CVE-2026-92039.html * https://www.suse.com/security/cve/CVE-2026-92041.html * https://www.suse.com/security/cve/CVE-2026-92042.html * https://www.suse.com/security/cve/CVE-2026-92043.html * https://www.suse.com/security/cve/CVE-2026-92044.html * https://www.suse.com/security/cve/CVE-2026-92045.html * https://www.suse.com/security/cve/CVE-2026-92046.html * https://www.suse.com/security/cve/CVE-2026-92047.html * https://www.suse.com/security/cve/CVE-2026-92048.html * https://www.suse.com/security/cve/CVE-2026-92049.html * https://www.suse.com/security/cve/CVE-2026-92052.html * https://www.suse.com/security/cve/CVE-2026-92053.html * https://www.suse.com/security/cve/CVE-2026-92054.html * https://www.suse.com/security/cve/CVE-2026-92055.html * https://www.suse.com/security/cve/CVE-2026-92056.html * https://www.suse.com/security/cve/CVE-2026-92057.html * https://www.suse.com/security/cve/CVE-2026-92058.html * https://www.suse.com/security/cve/CVE-2026-92059.html * https://www.suse.com/security/cve/CVE-2026-92060.html * https://www.suse.com/security/cve/CVE-2026-92062.html * https://www.suse.com/security/cve/CVE-2026-92064.html * https://www.suse.com/security/cve/CVE-2026-92065.html * https://www.suse.com/security/cve/CVE-2026-92067.html * https://www.suse.com/security/cve/CVE-2026-92068.html * https://www.suse.com/security/cve/CVE-2026-92069.html * https://www.suse.com/security/cve/CVE-2026-92070.html * https://www.suse.com/security/cve/CVE-2026-92071.html * https://www.suse.com/security/cve/CVE-2026-92072.html * https://www.suse.com/security/cve/CVE-2026-92073.html * https://www.suse.com/security/cve/CVE-2026-92074.html * https://www.suse.com/security/cve/CVE-2026-92075.html * https://www.suse.com/security/cve/CVE-2026-92076.html * https://www.suse.com/security/cve/CVE-2026-92077.html * https://www.suse.com/security/cve/CVE-2026-92078.html * https://www.suse.com/security/cve/CVE-2026-92079.html * https://bugzilla.suse.com/show_bug.cgi?id=1280371
Attachment: None (type=text/html)
(HTML attachment elided)
