SUSE-SU-2026:24661-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-202624661-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24661-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:24661-1
Upstream
CVE (147)
  • CVE-2026-100801
  • CVE-2026-111497
  • CVE-2026-117860
  • CVE-2026-117861
  • CVE-2026-117862
  • CVE-2026-117863
  • CVE-2026-117864
  • CVE-2026-117865
  • CVE-2026-117866
  • CVE-2026-117867
  • CVE-2026-117868
  • CVE-2026-117869
  • CVE-2026-117870
  • CVE-2026-117871
  • CVE-2026-117872
  • CVE-2026-117873
  • CVE-2026-117874
  • CVE-2026-117875
  • CVE-2026-117876
  • CVE-2026-117877
  • CVE-2026-117878
  • CVE-2026-117879
  • CVE-2026-117880
  • CVE-2026-117881
  • CVE-2026-117882
  • CVE-2026-117883
  • CVE-2026-117884
  • CVE-2026-117885
  • CVE-2026-117886
  • CVE-2026-117887
  • CVE-2026-117888
  • CVE-2026-117889
  • CVE-2026-117890
  • CVE-2026-117891
  • CVE-2026-117892
  • CVE-2026-117893
  • CVE-2026-117894
  • CVE-2026-117895
  • CVE-2026-117896
  • CVE-2026-117897
  • CVE-2026-117898
  • CVE-2026-117899
  • CVE-2026-117900
  • CVE-2026-117901
  • CVE-2026-117902
  • CVE-2026-117903
  • CVE-2026-117904
  • CVE-2026-117905
  • CVE-2026-117906
  • CVE-2026-117907
  • CVE-2026-117908
  • CVE-2026-117909
  • CVE-2026-117910
  • CVE-2026-117911
  • CVE-2026-117912
  • CVE-2026-117913
  • CVE-2026-117914
  • CVE-2026-117915
  • CVE-2026-117916
  • CVE-2026-117917
  • CVE-2026-117918
  • CVE-2026-117919
  • CVE-2026-117920
  • CVE-2026-117921
  • CVE-2026-117922
  • CVE-2026-117923
  • CVE-2026-117924
  • CVE-2026-117925
  • CVE-2026-117926
  • CVE-2026-117927
  • CVE-2026-117928
  • CVE-2026-117929
  • CVE-2026-117930
  • CVE-2026-117931
  • CVE-2026-117932
  • CVE-2026-117933
  • CVE-2026-117934
  • CVE-2026-117935
  • CVE-2026-117936
  • CVE-2026-117937
  • CVE-2026-117938
  • CVE-2026-117939
  • CVE-2026-117940
  • CVE-2026-117941
  • CVE-2026-117942
  • CVE-2026-117943
  • CVE-2026-117944
  • CVE-2026-117945
  • CVE-2026-117946
  • CVE-2026-117947
  • CVE-2026-117948
  • CVE-2026-117949
  • CVE-2026-117950
  • CVE-2026-117951
  • CVE-2026-117952
  • CVE-2026-117953
  • CVE-2026-117954
  • CVE-2026-117955
  • CVE-2026-117956
  • CVE-2026-117957
  • CVE-2026-117958
  • CVE-2026-117959
  • CVE-2026-117960
  • CVE-2026-117961
  • CVE-2026-117962
  • CVE-2026-117963
  • CVE-2026-117964
  • CVE-2026-117965
  • CVE-2026-117966
  • CVE-2026-117967
  • CVE-2026-117968
  • CVE-2026-117969
  • CVE-2026-117970
  • CVE-2026-117971
  • CVE-2026-117972
  • CVE-2026-117973
  • CVE-2026-117974
  • CVE-2026-117975
  • CVE-2026-117976
  • CVE-2026-117977
  • CVE-2026-117978
  • CVE-2026-117979
  • CVE-2026-117980
  • CVE-2026-117981
  • CVE-2026-117982
  • CVE-2026-117983
  • CVE-2026-117984
  • CVE-2026-117985
  • CVE-2026-117986
  • CVE-2026-117987
  • CVE-2026-117988
  • CVE-2026-117989
  • CVE-2026-117990
  • CVE-2026-117991
  • CVE-2026-117992
  • CVE-2026-117993
  • CVE-2026-117994
  • CVE-2026-117995
  • CVE-2026-117996
  • CVE-2026-117997
  • CVE-2026-117998
  • CVE-2026-117999
  • CVE-2026-118000
  • CVE-2026-118002
  • CVE-2026-118003
  • CVE-2026-118004
  • CVE-2026-6785
Related
CVE (147)
  • CVE-2026-100801
  • CVE-2026-111497
  • CVE-2026-117860
  • CVE-2026-117861
  • CVE-2026-117862
  • CVE-2026-117863
  • CVE-2026-117864
  • CVE-2026-117865
  • CVE-2026-117866
  • CVE-2026-117867
  • CVE-2026-117868
  • CVE-2026-117869
  • CVE-2026-117870
  • CVE-2026-117871
  • CVE-2026-117872
  • CVE-2026-117873
  • CVE-2026-117874
  • CVE-2026-117875
  • CVE-2026-117876
  • CVE-2026-117877
  • CVE-2026-117878
  • CVE-2026-117879
  • CVE-2026-117880
  • CVE-2026-117881
  • CVE-2026-117882
  • CVE-2026-117883
  • CVE-2026-117884
  • CVE-2026-117885
  • CVE-2026-117886
  • CVE-2026-117887
  • CVE-2026-117888
  • CVE-2026-117889
  • CVE-2026-117890
  • CVE-2026-117891
  • CVE-2026-117892
  • CVE-2026-117893
  • CVE-2026-117894
  • CVE-2026-117895
  • CVE-2026-117896
  • CVE-2026-117897
  • CVE-2026-117898
  • CVE-2026-117899
  • CVE-2026-117900
  • CVE-2026-117901
  • CVE-2026-117902
  • CVE-2026-117903
  • CVE-2026-117904
  • CVE-2026-117905
  • CVE-2026-117906
  • CVE-2026-117907
  • CVE-2026-117908
  • CVE-2026-117909
  • CVE-2026-117910
  • CVE-2026-117911
  • CVE-2026-117912
  • CVE-2026-117913
  • CVE-2026-117914
  • CVE-2026-117915
  • CVE-2026-117916
  • CVE-2026-117917
  • CVE-2026-117918
  • CVE-2026-117919
  • CVE-2026-117920
  • CVE-2026-117921
  • CVE-2026-117922
  • CVE-2026-117923
  • CVE-2026-117924
  • CVE-2026-117925
  • CVE-2026-117926
  • CVE-2026-117927
  • CVE-2026-117928
  • CVE-2026-117929
  • CVE-2026-117930
  • CVE-2026-117931
  • CVE-2026-117932
  • CVE-2026-117933
  • CVE-2026-117934
  • CVE-2026-117935
  • CVE-2026-117936
  • CVE-2026-117937
  • CVE-2026-117938
  • CVE-2026-117939
  • CVE-2026-117940
  • CVE-2026-117941
  • CVE-2026-117942
  • CVE-2026-117943
  • CVE-2026-117944
  • CVE-2026-117945
  • CVE-2026-117946
  • CVE-2026-117947
  • CVE-2026-117948
  • CVE-2026-117949
  • CVE-2026-117950
  • CVE-2026-117951
  • CVE-2026-117952
  • CVE-2026-117953
  • CVE-2026-117954
  • CVE-2026-117955
  • CVE-2026-117956
  • CVE-2026-117957
  • CVE-2026-117958
  • CVE-2026-117959
  • CVE-2026-117960
  • CVE-2026-117961
  • CVE-2026-117962
  • CVE-2026-117963
  • CVE-2026-117964
  • CVE-2026-117965
  • CVE-2026-117966
  • CVE-2026-117967
  • CVE-2026-117968
  • CVE-2026-117969
  • CVE-2026-117970
  • CVE-2026-117971
  • CVE-2026-117972
  • CVE-2026-117973
  • CVE-2026-117974
  • CVE-2026-117975
  • CVE-2026-117976
  • CVE-2026-117977
  • CVE-2026-117978
  • CVE-2026-117979
  • CVE-2026-117980
  • CVE-2026-117981
  • CVE-2026-117982
  • CVE-2026-117983
  • CVE-2026-117984
  • CVE-2026-117985
  • CVE-2026-117986
  • CVE-2026-117987
  • CVE-2026-117988
  • CVE-2026-117989
  • CVE-2026-117990
  • CVE-2026-117991
  • CVE-2026-117992
  • CVE-2026-117993
  • CVE-2026-117994
  • CVE-2026-117995
  • CVE-2026-117996
  • CVE-2026-117997
  • CVE-2026-117998
  • CVE-2026-117999
  • CVE-2026-118000
  • CVE-2026-118002
  • CVE-2026-118003
  • CVE-2026-118004
  • CVE-2026-6785
Published
2026-11-09T11:39:44Z
Modified
2026-11-12T17:23:20Z
Summary
Security update for MozillaFirefox
Details

This update for MozillaFirefox fixes the following issues:

Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-120, bsc#1286955):

  • CVE-2026-100801: Privilege escalation in the DLL Services component.
  • CVE-2026-111497: brotli: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287809).
  • CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component.
  • CVE-2026-117861: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component.
  • CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component.
  • CVE-2026-117864: Sandbox escape in the Form Manager component.
  • CVE-2026-117865: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-117867: Use-after-free in the Layout component.
  • CVE-2026-117868: Sandbox escape in the DOM: Networking component.
  • CVE-2026-117869: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117870: Use-after-free in the JavaScript Engine component.
  • CVE-2026-117871: Invalid pointer in the Graphics component.
  • CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component.
  • CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component.
  • CVE-2026-117874: Use-after-free in the Internationalization component.
  • CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component.
  • CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component.
  • CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component.
  • CVE-2026-117880: Use-after-free in the XML component.
  • CVE-2026-117881: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117882: Use-after-free in the Layout component.
  • CVE-2026-117883: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-117884: Use-after-free in the Networking component.
  • CVE-2026-117885: Use-after-free in the Layout: Grid component.
  • CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component.
  • CVE-2026-117887: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component.
  • CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component.
  • CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component.
  • CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component.
  • CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component.
  • CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component.
  • CVE-2026-117895: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117896: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component.
  • CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component.
  • CVE-2026-117899: Use-after-free in the Networking: HTTP component.
  • CVE-2026-117900: Use-after-free in the DOM: Editor component.
  • CVE-2026-117901: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-117903: Use-after-free in the Audio/Video component.
  • CVE-2026-117904: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117905: Use-after-free in the Audio/Video: Playback component.
  • CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-117907: Use-after-free in the Networking component.
  • CVE-2026-117908: Use-after-free in the Graphics: ImageLib component.
  • CVE-2026-117909: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117910: Invalid pointer in the JavaScript Engine component.
  • CVE-2026-117911: Use-after-free in the Audio/Video: Playback component.
  • CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component.
  • CVE-2026-117913: Use-after-free in the SVG component.
  • CVE-2026-117914: Use-after-free in the SVG component.
  • CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component.
  • CVE-2026-117916: Use-after-free in the XSLT component.
  • CVE-2026-117917: Invalid pointer in the Graphics: WebRender component.
  • CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-117919: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117920: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-117922: Use-after-free in the Networking: WebSockets component.
  • CVE-2026-117923: Use-after-free in the Audio/Video component.
  • CVE-2026-117924: Use-after-free in the XSLT component.
  • CVE-2026-117925: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117926: Incorrect boundary conditions in the SVG component.
  • CVE-2026-117927: Use-after-free in the SVG component.
  • CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component.
  • CVE-2026-117929: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component.
  • CVE-2026-117931: Use-after-free in the DOM: Events component.
  • CVE-2026-117932: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component.
  • CVE-2026-117934: Use-after-free in the Layout component.
  • CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component.
  • CVE-2026-117936: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117937: Invalid pointer in the JavaScript Engine component.
  • CVE-2026-117938: Use-after-free in the Layout component.
  • CVE-2026-117939: Use-after-free in the XML component.
  • CVE-2026-117940: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component.
  • CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component.
  • CVE-2026-117943: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117944: Use-after-free in the Layout component.
  • CVE-2026-117945: Incorrect boundary conditions in the XML component.
  • CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component.
  • CVE-2026-117947: Use-after-free in the XML component.
  • CVE-2026-117948: Use-after-free in the SVG component.
  • CVE-2026-117949: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component.
  • CVE-2026-117951: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117952: Uninitialized memory in the Networking component.
  • CVE-2026-117953: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117954: Use-after-free in the Layout: Positioned component.
  • CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component.
  • CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component.
  • CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component.
  • CVE-2026-117958: Site isolation issue in the Networking: HTTP component.
  • CVE-2026-117959: Site isolation issue in the DOM: Service Workers component.
  • CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component.
  • CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component.
  • CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component.
  • CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component.
  • CVE-2026-117964: Use-after-free in the Panning and Zooming component.
  • CVE-2026-117965: Same-origin policy bypass in the Address Bar component.
  • CVE-2026-117966: Site isolation issue in the Networking: HTTP component.
  • CVE-2026-117967: Mitigation bypass in the DOM: Security component.
  • CVE-2026-117968: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component.
  • CVE-2026-117970: Race condition in the Disability Access APIs component.
  • CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component.
  • CVE-2026-117972: Use-after-free in the Graphics component.
  • CVE-2026-117973: Use-after-free in the Networking: DNS component.
  • CVE-2026-117974: Use-after-free in the XML component.
  • CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component.
  • CVE-2026-117976: Site isolation issue in the DOM: Navigation component.
  • CVE-2026-117977: Other issue in the Console component.
  • CVE-2026-117978: Incorrect boundary conditions in the Graphics component.
  • CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-117980: Use-after-free in the Graphics component.
  • CVE-2026-117981: Privilege escalation in the Toolkit component.
  • CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component.
  • CVE-2026-117983: Use-after-free in the Graphics component.
  • CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component.
  • CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component.
  • CVE-2026-117986: Use-after-free in the Graphics component.
  • CVE-2026-117987: Use-after-free in the Graphics component.
  • CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component.
  • CVE-2026-117989: Use-after-free in the Graphics component.
  • CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component.
  • CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component.
  • CVE-2026-117993: Integer overflow in the Graphics: Text component.
  • CVE-2026-117994: Use-after-free in the JavaScript: GC component.
  • CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling component.
  • CVE-2026-117996: Incorrect boundary conditions in the WebRTC component.
  • CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component.
  • CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component.
  • CVE-2026-117999: Race condition in the IPC component.
  • CVE-2026-118000: Information disclosure in the Networking: HTTP component.
  • CVE-2026-118002: Information disclosure due to race condition in the Networking component.
  • CVE-2026-118003: Information disclosure in the Networking: DNS component.
  • CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component.
References

Affected packages

SUSE:Linux Enterprise Server 16.0 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.6.0-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.6.0-160000.1.1",
            "MozillaFirefox-devel": "153.6.0-160000.1.1",
            "MozillaFirefox-translations-common": "153.6.0-160000.1.1",
            "MozillaFirefox-translations-other": "153.6.0-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24661-1.json"

SUSE:Linux Enterprise Server for SAP applications 16.0 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.6.0-160000.1.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.6.0-160000.1.1",
            "MozillaFirefox-devel": "153.6.0-160000.1.1",
            "MozillaFirefox-translations-common": "153.6.0-160000.1.1",
            "MozillaFirefox-translations-other": "153.6.0-160000.1.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:24661-1.json"