openSUSE-SU-2026:22139-1

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

• CVE-2026-109704: Privilege escalation in the Application Update component.
• CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component.
• CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
• CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
• CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
• CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component.
• CVE-2026-109710: Use-after-free in the Graphics: Text component.
• CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
• CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
• CVE-2026-109713: Use-after-free in the Crash Reporting component.
• CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
• CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
• CVE-2026-109718: Use-after-free in the XML component.
• CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
• CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
• CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
• CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
• CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
• CVE-2026-109726: Use-after-free in the SVG component.
• CVE-2026-109727: Use-after-free in the Audio/Video component.
• CVE-2026-109728: Use-after-free in the DOM: Animation component.
• CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
• CVE-2026-109730: Integer overflow in the Graphics component.
• CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
• CVE-2026-109732: Use-after-free in the DOM: Streams component.
• CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
• CVE-2026-109734: Mitigation bypass in the DOM: Security component.
• CVE-2026-109736: Frame poisoning in the Layout component.
• CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
• CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
• CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
• CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
• CVE-2026-109742: Information disclosure in the PDF Viewer component.
• CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
• CVE-2026-109744: Other issue in the DOM: File component.
• CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
• CVE-2026-109751: Information disclosure in the Networking component.
• CVE-2026-109752: Use-after-free in the DOM: Workers component.
• CVE-2026-109753: Incorrect boundary conditions in the Layout component.
• CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
• CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
• CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
• CVE-2026-109759: Site isolation issue in the Networking component.
• CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
• CVE-2026-109762: Incorrect boundary conditions in the SVG component.
• CVE-2026-109763: Mitigation bypass in the File Handling component.
• CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.
• CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.
• CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.
• CVE-2026-109767: Information disclosure in the Networking component.
• CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.
• CVE-2026-109775: Denial-of-service in the WebRTC component.
• CVE-2026-109776: Race condition in the XPCOM component.
• CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.
• CVE-2026-109778: Privilege escalation in the WebExtensions component.
• CVE-2026-109781: Denial-of-service in the Printing: Output component.
• CVE-2026-109782: Mitigation bypass in the File Handling component.
• CVE-2026-109783: Mitigation bypass in the File Handling component.

libexpat updated:

• CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value. (bsc#1259727)
• CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)
• CVE-2026-32778: libexpat: NULL pointer dereference in setContext on retry after an out-of-memory condition. (bsc#1259730)
• CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML document. (bsc#1262263)
• CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input. (bsc#1264713)
• CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in libexpat could lead to information disclosure, integrity loss, or denial of service. (bsc#1275098)
• CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for XML_ResumeParser in libexpat could lead to denial of service. (bsc#1275098)
• CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in libexpat could lead to denial of service or memory corruption. (bsc#1275098)
• CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in libexpat could lead to memory corruption. (bsc#1275098)
• CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could lead to memory corruption and potential security risks. (bsc#1275098)
• CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)
• CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)
• CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)
• CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could lead to memory corruption. (bsc#1275098)
• CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)
• CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to denial of service. (bsc#1275098)
• CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or denial of service. (bsc#1275098)
• CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in libexpat could lead to denial of service or memory corruption. (bsc#1275098)
• CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c. (bsc#1275736)
• CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing functions in libexpat allowed attackers to cause denial of service. (bsc#1275605)
• CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat allowed attackers to trigger memory corruption or a crash. (bsc#1275736)
• CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code in libexpat allowed attackers to cause a denial of service via hash flooding attacks. (bsc#1275736)
• CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with custom encoding callbacks in libexpat could lead to memory corruption. (bsc#1275736)
• CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat allowed attackers to pass unpaired surrogates or silently replace input characters. (bsc#1282347)