MGASA-2026-0145
- Source
- https://advisories.mageia.org/MGASA-2026-0145.html
- Import Source
- https://advisories.mageia.org/MGASA-2026-0145.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2026-0145
- Upstream
- Published
- 2026-05-16T17:45:40Z
- Modified
- 2026-05-16T18:00:05.930851Z
- Summary
- Updated firefox & thunderbird packages fix security vulnerabilities
- Details
-
LZ4 compression library issue. (CVE-2025-62813) libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. (CVE-2026-32776) libexpat before 2.7.5 allows an infinite loop while parsing DTD content. (CVE-2026-32777) libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. (CVE-2026-32778) Use-after-free in the DOM: Networking component. (CVE-2026-8090) Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2, Firefox 150.0.2, Thunderbird ESR 140.10.2 and Thunderbird 150.0.2. (CVE-2026-8092) Another issue in the WebRTC component. (CVE-2026-8094)
- References
-
- https://advisories.mageia.org/MGASA-2026-0145.html
- https://bugs.mageia.org/show_bug.cgi?id=35508
- https://www.firefox.com/en-US/firefox/140.10.2/releasenotes/
- https://www.thunderbird.net/en-US/thunderbird/140.10.2esr/releasenotes/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-41/
- https://www.mozilla.org/en-US/security/advisories/mfsa2026-44/
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:9 / firefox
Package
- Name
- firefox
- Purl
- pkg:rpm/mageia/firefox?arch=source&distro=mageia-9
Mageia:9 / firefox-l10n
Package
- Name
- firefox-l10n
- Purl
- pkg:rpm/mageia/firefox-l10n?arch=source&distro=mageia-9
Mageia:9 / thunderbird
Package
- Name
- thunderbird
- Purl
- pkg:rpm/mageia/thunderbird?arch=source&distro=mageia-9
Mageia:9 / thunderbird-l10n
Package
- Name
- thunderbird-l10n
- Purl
- pkg:rpm/mageia/thunderbird-l10n?arch=source&distro=mageia-9