SUSE-SU-2026:5174-1

See a problem?
Please try reporting it to the source first.
Source
https://www.suse.com/support/update/announcement/2026/suse-su-20265174-1/
Import Source
https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5174-1.json
JSON Data
https://api.osv.dev/v1/vulns/SUSE-SU-2026:5174-1
Upstream
CVE (81)
  • CVE-2026-118007
  • CVE-2026-118019
  • CVE-2026-118021
  • CVE-2026-118024
  • CVE-2026-124853
  • CVE-2026-124854
  • CVE-2026-124855
  • CVE-2026-124856
  • CVE-2026-124857
  • CVE-2026-124858
  • CVE-2026-124859
  • CVE-2026-124860
  • CVE-2026-124861
  • CVE-2026-124862
  • CVE-2026-124863
  • CVE-2026-124864
  • CVE-2026-124865
  • CVE-2026-124866
  • CVE-2026-124868
  • CVE-2026-124869
  • CVE-2026-124870
  • CVE-2026-124872
  • CVE-2026-124873
  • CVE-2026-124874
  • CVE-2026-124875
  • CVE-2026-124876
  • CVE-2026-124877
  • CVE-2026-124879
  • CVE-2026-124880
  • CVE-2026-124881
  • CVE-2026-124882
  • CVE-2026-124883
  • CVE-2026-124884
  • CVE-2026-124885
  • CVE-2026-124886
  • CVE-2026-124887
  • CVE-2026-124888
  • CVE-2026-124889
  • CVE-2026-124890
  • CVE-2026-124891
  • CVE-2026-124892
  • CVE-2026-124893
  • CVE-2026-124894
  • CVE-2026-124895
  • CVE-2026-124896
  • CVE-2026-124897
  • CVE-2026-124898
  • CVE-2026-124899
  • CVE-2026-124901
  • CVE-2026-124902
  • CVE-2026-124903
  • CVE-2026-124905
  • CVE-2026-124906
  • CVE-2026-124907
  • CVE-2026-124909
  • CVE-2026-124910
  • CVE-2026-124912
  • CVE-2026-124913
  • CVE-2026-124914
  • CVE-2026-124915
  • CVE-2026-124917
  • CVE-2026-124918
  • CVE-2026-124919
  • CVE-2026-124922
  • CVE-2026-124924
  • CVE-2026-124926
  • CVE-2026-124927
  • CVE-2026-124929
  • CVE-2026-124930
  • CVE-2026-124931
  • CVE-2026-124932
  • CVE-2026-124933
  • CVE-2026-124934
  • CVE-2026-124935
  • CVE-2026-124938
  • CVE-2026-124939
  • CVE-2026-124940
  • CVE-2026-124941
  • CVE-2026-124942
  • CVE-2026-124948
  • CVE-2026-124951
Related
CVE (81)
  • CVE-2026-118007
  • CVE-2026-118019
  • CVE-2026-118021
  • CVE-2026-118024
  • CVE-2026-124853
  • CVE-2026-124854
  • CVE-2026-124855
  • CVE-2026-124856
  • CVE-2026-124857
  • CVE-2026-124858
  • CVE-2026-124859
  • CVE-2026-124860
  • CVE-2026-124861
  • CVE-2026-124862
  • CVE-2026-124863
  • CVE-2026-124864
  • CVE-2026-124865
  • CVE-2026-124866
  • CVE-2026-124868
  • CVE-2026-124869
  • CVE-2026-124870
  • CVE-2026-124872
  • CVE-2026-124873
  • CVE-2026-124874
  • CVE-2026-124875
  • CVE-2026-124876
  • CVE-2026-124877
  • CVE-2026-124879
  • CVE-2026-124880
  • CVE-2026-124881
  • CVE-2026-124882
  • CVE-2026-124883
  • CVE-2026-124884
  • CVE-2026-124885
  • CVE-2026-124886
  • CVE-2026-124887
  • CVE-2026-124888
  • CVE-2026-124889
  • CVE-2026-124890
  • CVE-2026-124891
  • CVE-2026-124892
  • CVE-2026-124893
  • CVE-2026-124894
  • CVE-2026-124895
  • CVE-2026-124896
  • CVE-2026-124897
  • CVE-2026-124898
  • CVE-2026-124899
  • CVE-2026-124901
  • CVE-2026-124902
  • CVE-2026-124903
  • CVE-2026-124905
  • CVE-2026-124906
  • CVE-2026-124907
  • CVE-2026-124909
  • CVE-2026-124910
  • CVE-2026-124912
  • CVE-2026-124913
  • CVE-2026-124914
  • CVE-2026-124915
  • CVE-2026-124917
  • CVE-2026-124918
  • CVE-2026-124919
  • CVE-2026-124922
  • CVE-2026-124924
  • CVE-2026-124926
  • CVE-2026-124927
  • CVE-2026-124929
  • CVE-2026-124930
  • CVE-2026-124931
  • CVE-2026-124932
  • CVE-2026-124933
  • CVE-2026-124934
  • CVE-2026-124935
  • CVE-2026-124938
  • CVE-2026-124939
  • CVE-2026-124940
  • CVE-2026-124941
  • CVE-2026-124942
  • CVE-2026-124948
  • CVE-2026-124951
Published
2026-11-10T15:32:04Z
Modified
2026-11-11T13:00:04Z
Summary
Security update for MozillaFirefox
Details

This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.7.0 ESR (MFSA 2026-127, bsc#1289275):

  • CVE-2026-118007: Use-after-free in the JavaScript: GC component.
  • CVE-2026-118019: Race condition, use-after-free in the DOM: File component.
  • CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component.
  • CVE-2026-118024: Use-after-free in the Graphics: Text component.
  • CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component.
  • CVE-2026-124854: Privilege escalation in the DOM: Navigation component.
  • CVE-2026-124855: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-124856: Incorrect boundary conditions in the Networking: HTTP component.
  • CVE-2026-124857: Use-after-free in the Graphics: Canvas2D component.
  • CVE-2026-124858: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-124859: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component.
  • CVE-2026-124860: Use-after-free in the Audio/Video component.
  • CVE-2026-124861: Sandbox escape due to use-after-free in the Audio/Video: cubeb component.
  • CVE-2026-124862: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-124863: Use-after-free in the DOM: HTML Parser component.
  • CVE-2026-124864: Sandbox escape due to use-after-free in the DOM: Service Workers component.
  • CVE-2026-124865: Use-after-free in the Audio/Video component.
  • CVE-2026-124866: Use-after-free in the Layout component.
  • CVE-2026-124868: Incorrect boundary conditions in the DOM: Core & HTML component.
  • CVE-2026-124869: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-124870: Incorrect boundary conditions in the JavaScript: GC component.
  • CVE-2026-124872: Use-after-free in the Cycle Collector component.
  • CVE-2026-124873: Invalid pointer in the DOM: Editor component.
  • CVE-2026-124874: Same-origin policy bypass in the Networking: HTTP component.
  • CVE-2026-124875: Incorrect boundary conditions in the DOM: CSS Object Model component.
  • CVE-2026-124876: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-124877: Use-after-free in the Layout: Positioned component.
  • CVE-2026-124879: Invalid pointer in the Networking: Cache component.
  • CVE-2026-124880: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-124881: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-124882: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-124883: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-124884: Use-after-free in the JavaScript: GC component.
  • CVE-2026-124885: Use-after-free in the Graphics: Text component.
  • CVE-2026-124886: Invalid pointer in the Layout: Text and Fonts component.
  • CVE-2026-124887: Incorrect boundary conditions in the Layout: Text and Fonts component.
  • CVE-2026-124888: Incorrect boundary conditions in the Layout: Text and Fonts component.
  • CVE-2026-124889: Use-after-free in the CSS Parsing and Computation component.
  • CVE-2026-124890: Use-after-free in the DOM: Core & HTML component.
  • CVE-2026-124891: Incorrect boundary conditions in the DOM: Selection component.
  • CVE-2026-124892: Use-after-free in the JavaScript: GC component.
  • CVE-2026-124893: Use-after-free in the DOM: Workers component.
  • CVE-2026-124894: Use-after-free in the Networking: Cookies component.
  • CVE-2026-124895: Use-after-free in the Storage: localStorage & sessionStorage component.
  • CVE-2026-124896: Invalid pointer in the Layout: Text and Fonts component.
  • CVE-2026-124897: Use-after-free in the JavaScript: GC component.
  • CVE-2026-124898: Use-after-free in the DOM: Editor component.
  • CVE-2026-124899: Use-after-free in the Layout: Text and Fonts component.
  • CVE-2026-124901: Other issue in the Networking: JAR component.
  • CVE-2026-124902: Same-origin policy bypass due to race condition in the Audio/Video component.
  • CVE-2026-124903: Sandbox escape due to use-after-free in the IPC component.
  • CVE-2026-124905: Sandbox escape in the DOM: Navigation component.
  • CVE-2026-124906: Use-after-free in the Graphics: WebRender component.
  • CVE-2026-124907: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component.
  • CVE-2026-124909: Information disclosure in the Private Browsing component.
  • CVE-2026-124910: Mitigation bypass in the WebExtensions component.
  • CVE-2026-124912: Spoofing issue in the DOM: Security component.
  • CVE-2026-124913: Site isolation issue in the Networking component.
  • CVE-2026-124914: Site isolation issue in the DOM: Navigation component.
  • CVE-2026-124915: Incorrect boundary conditions in the Graphics: WebGPU component.
  • CVE-2026-124917: Sandbox escape due to use-after-free in the Widget: Gtk component.
  • CVE-2026-124918: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-124919: Privilege escalation due to use-after-free in the WebRTC: Networking component.
  • CVE-2026-124922: Use-after-free in the CSS Transitions and Animations component.
  • CVE-2026-124924: Incorrect boundary conditions in the Graphics: WebRender component.
  • CVE-2026-124926: Incorrect boundary conditions in the WebRTC component.
  • CVE-2026-124927: Site isolation issue in the Graphics: WebRender component.
  • CVE-2026-124929: Information disclosure in the Layout: Form Controls component.
  • CVE-2026-124930: Information disclosure in the Address Bar component.
  • CVE-2026-124931: Same-origin policy bypass in the DOM: Core & HTML component.
  • CVE-2026-124932: Use-after-free in the Graphics component.
  • CVE-2026-124933: Sandbox escape in the Console component.
  • CVE-2026-124934: Spoofing issue in the Security component.
  • CVE-2026-124935: Undefined behavior in the WebRTC: Networking component.
  • CVE-2026-124938: Mitigation bypass in the Add-ons Manager component.
  • CVE-2026-124939: JIT miscompilation in the JavaScript Engine: JIT component.
  • CVE-2026-124940: Mitigation bypass in the File Handling component.
  • CVE-2026-124941: Information disclosure in the Security: RLBox component.
  • CVE-2026-124942: Invalid pointer in the DOM: Streams component.
  • CVE-2026-124948: Incorrect boundary conditions, use-after-free in the Graphics component.
  • CVE-2026-124951: Privilege escalation in the Nimbus Desktop Client component.
References

Affected packages

SUSE:Linux Enterprise Server 12 SP5-LTSS / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.7.0-118.22.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.7.0-118.22.1",
            "MozillaFirefox-devel": "153.7.0-118.22.1",
            "MozillaFirefox-translations-common": "153.7.0-118.22.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5174-1.json"

SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 / MozillaFirefox

Package

Name
MozillaFirefox
Purl
pkg:rpm/suse/MozillaFirefox&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
153.7.0-118.22.1

Ecosystem specific 

{
    "binaries": [
        {
            "MozillaFirefox": "153.7.0-118.22.1",
            "MozillaFirefox-devel": "153.7.0-118.22.1",
            "MozillaFirefox-translations-common": "153.7.0-118.22.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:5174-1.json"