SUSE-SU-2026:23981-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202623981-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23981-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:23981-1
Upstream
CVE (62)
  • CVE-2026-100756
  • CVE-2026-100757
  • CVE-2026-100758
  • CVE-2026-100759
  • CVE-2026-100760
  • CVE-2026-100762
  • CVE-2026-100765
  • CVE-2026-100766
  • CVE-2026-100767
  • CVE-2026-100769
  • CVE-2026-100770
  • CVE-2026-100771
  • CVE-2026-100772
  • CVE-2026-100773
  • CVE-2026-100774
  • CVE-2026-100775
  • CVE-2026-100776
  • CVE-2026-100777
  • CVE-2026-100778
  • CVE-2026-100779
  • CVE-2026-100780
  • CVE-2026-100781
  • CVE-2026-100782
  • CVE-2026-100783
  • CVE-2026-100784
  • CVE-2026-100785
  • CVE-2026-100786
  • CVE-2026-100787
  • CVE-2026-100788
  • CVE-2026-100789
  • CVE-2026-100790
  • CVE-2026-100791
  • CVE-2026-100792
  • CVE-2026-100794
  • CVE-2026-100797
  • CVE-2026-100798
  • CVE-2026-100800
  • CVE-2026-100801
  • CVE-2026-100803
  • CVE-2026-100806
  • CVE-2026-100807
  • CVE-2026-100808
  • CVE-2026-100809
  • CVE-2026-100811
  • CVE-2026-100812
  • CVE-2026-100814
  • CVE-2026-100815
  • CVE-2026-100816
  • CVE-2026-100818
  • CVE-2026-100819
  • CVE-2026-100820
  • CVE-2026-100821
  • CVE-2026-100822
  • CVE-2026-100824
  • CVE-2026-100825
  • CVE-2026-100826
  • CVE-2026-100828
  • CVE-2026-100829
  • CVE-2026-100830
  • CVE-2026-100831
  • CVE-2026-100832
  • CVE-2026-96869
Related
CVE (62)
  • CVE-2026-100756
  • CVE-2026-100757
  • CVE-2026-100758
  • CVE-2026-100759
  • CVE-2026-100760
  • CVE-2026-100762
  • CVE-2026-100765
  • CVE-2026-100766
  • CVE-2026-100767
  • CVE-2026-100769
  • CVE-2026-100770
  • CVE-2026-100771
  • CVE-2026-100772
  • CVE-2026-100773
  • CVE-2026-100774
  • CVE-2026-100775
  • CVE-2026-100776
  • CVE-2026-100777
  • CVE-2026-100778
  • CVE-2026-100779
  • CVE-2026-100780
  • CVE-2026-100781
  • CVE-2026-100782
  • CVE-2026-100783
  • CVE-2026-100784
  • CVE-2026-100785
  • CVE-2026-100786
  • CVE-2026-100787
  • CVE-2026-100788
  • CVE-2026-100789
  • CVE-2026-100790
  • CVE-2026-100791
  • CVE-2026-100792
  • CVE-2026-100794
  • CVE-2026-100797
  • CVE-2026-100798
  • CVE-2026-100800
  • CVE-2026-100801
  • CVE-2026-100803
  • CVE-2026-100806
  • CVE-2026-100807
  • CVE-2026-100808
  • CVE-2026-100809
  • CVE-2026-100811
  • CVE-2026-100812
  • CVE-2026-100814
  • CVE-2026-100815
  • CVE-2026-100816
  • CVE-2026-100818
  • CVE-2026-100819
  • CVE-2026-100820
  • CVE-2026-100821
  • CVE-2026-100822
  • CVE-2026-100824
  • CVE-2026-100825
  • CVE-2026-100826
  • CVE-2026-100828
  • CVE-2026-100829
  • CVE-2026-100830
  • CVE-2026-100831
  • CVE-2026-100832
  • CVE-2026-96869
Published
2026-09-30T13:03:58Z
Modified
2026-10-06T17:23:09Z
Summary
Security update for MozillaFirefox
Details

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.4.0 ESR (MFSA 2026-100, bsc#1282929):

  • CVE-2026-96869: Information disclosure in the Networking component.
  • CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.
  • CVE-2026-100757: Use-after-free in the Widget component.
  • CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.
  • CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.
  • CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component.
  • CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100766: Information disclosure in the Networking: JAR component.
  • CVE-2026-100767: Use-after-free in the Networking: Cache component.
  • CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component.
  • CVE-2026-100771: Undefined behavior in the DOM: Streams component.
  • CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.
  • CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100775: Sandbox escape in the Graphics component.
  • CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.
  • CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100779: Use-after-free in the XSLT component.
  • CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component.
  • CVE-2026-100783: Uninitialized memory in the Audio/Video component.
  • CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component.
  • CVE-2026-100787: Sandbox escape in the XUL component.
  • CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.
  • CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-100790: Use-after-free in the XSLT component.
  • CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component.
  • CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component.
  • CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component.
  • CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.
  • CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component.
  • CVE-2026-100801: Privilege escalation in the DLL Services component.
  • CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.
  • CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.
  • CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.
  • CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.
  • CVE-2026-100809: Same-origin policy bypass in the DevTools component.
  • CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
  • CVE-2026-100812: Denial-of-service in the Graphics component.
  • CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component.
  • CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-100816: Site isolation issue in the DOM: Networking component.
  • CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component.
  • CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component.
  • CVE-2026-100820: Privilege escalation in the Address Bar component.
  • CVE-2026-100821: Site isolation issue in the Panning and Zooming component.
  • CVE-2026-100822: Spoofing issue in the Networking: HTTP component.
  • CVE-2026-100824: Privilege escalation in the Places component.
  • CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.
  • CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.
  • CVE-2026-100829: Mitigation bypass in the DOM: Security component.
  • CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.
  • CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component.
  • CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.
References

Affected packages

SUSE:Linux Enterprise Server 16.0 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.4.0-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.4.0-160000.1.1",
            "MozillaFirefox-devel": "153.4.0-160000.1.1",
            "MozillaFirefox-translations-common": "153.4.0-160000.1.1",
            "MozillaFirefox-translations-other": "153.4.0-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23981-1.json"

SUSE:Linux Enterprise Server for SAP applications 16.0 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.4.0-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.4.0-160000.1.1",
            "MozillaFirefox-devel": "153.4.0-160000.1.1",
            "MozillaFirefox-translations-common": "153.4.0-160000.1.1",
            "MozillaFirefox-translations-other": "153.4.0-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:23981-1.json"