RLSA-2026:69461

See a problem?
Please try reporting it to the source first.
Source
https://errata.rockylinux.org/RLSA-2026:69461
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2026:69461.json
JSON Data
https://api.osv.dev/v1/vulns/RLSA-2026:69461
Upstream
CVE (28)
  • CVE-2026-92005
  • CVE-2026-92006
  • CVE-2026-92007
  • CVE-2026-92008
  • CVE-2026-92009
  • CVE-2026-92010
  • CVE-2026-92011
  • CVE-2026-92012
  • CVE-2026-92013
  • CVE-2026-92014
  • CVE-2026-92015
  • CVE-2026-92016
  • CVE-2026-92017
  • CVE-2026-92018
  • CVE-2026-92019
  • CVE-2026-92020
  • CVE-2026-92021
  • CVE-2026-92022
  • CVE-2026-92023
  • CVE-2026-92024
  • CVE-2026-92025
  • CVE-2026-92026
  • CVE-2026-92027
  • CVE-2026-92028
  • CVE-2026-92029
  • CVE-2026-92030
  • CVE-2026-92031
  • CVE-2026-92032
Published
2026-09-22T12:08:07Z
Modified
2026-09-22T12:30:02Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Important: firefox security update
Details

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92024)

  • firefox: thunderbird: Mitigation bypass in the Remote Settings Client component (CVE-2026-92019)

  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-92026)

  • firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-92031)

  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component (CVE-2026-92032)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92010)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92006)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92011)

  • firefox: thunderbird: Use-after-free in the DOM: Streams component (CVE-2026-92027)

  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-92028)

  • firefox: thunderbird: Privilege escalation in the WebExtensions component (CVE-2026-92015)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92013)

  • firefox: thunderbird: Use-after-free in the Disability Access APIs component (CVE-2026-92016)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92012)

  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-92022)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics component (CVE-2026-92014)

  • firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component (CVE-2026-92018)

  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-92021)

  • firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component (CVE-2026-92005)

  • firefox: thunderbird: Privilege escalation in the DOM: Service Workers component (CVE-2026-92017)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92009)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-92020)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92008)

  • firefox: thunderbird: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVE-2026-92030)

  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-92007)

  • firefox: thunderbird: Use-after-free in the DOM: Navigation component (CVE-2026-92025)

  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-92029)

  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-92023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Database specific 
{
    "license":  "CC-BY-4.0",
    "license_url":  "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory":  "RHSA-2026:69461"
}
References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:10 / firefox

Package

Name
firefox
Purl
pkg:rpm/rocky-linux/firefox?distro=rocky-linux-10&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0:140.16.0-1.el10_2
Database specific
Show details 
{
    "yum_repository":  "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:69461.json"