The vulnerability of the Audio/Video components in Firefox and Firefox ESR web browsers, as well as the Thunderbird email client, allows attackers to gain access to confidential data.

The vulnerability of the Audio/Video components in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, is related to the execution of operations beyond the buffer limits in memory. Exploiting this vulnerability can allow an attacker to gain access to confidential dat...

RLSA-2026:58897 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component CVE-2026-74983 firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL...

Astra Linux – Vulnerability in Firefox

The timing of a button click that causes a pop-up to disappear was approximately the same duration as the delay in permission prompts to prevent clickjacking attacks. This fact could be used to surprise users by forcing them to click where the permission grant button was about to appear. This...

Astra Linux – Vulnerability in Firefox and Thunderbird

The WebGL DrawElementsInstanced method was vulnerable to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

Astra Linux – Vulnerability in Thunderbird, Firefox

Memory safety bugs exist in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has be...

Astra Linux – Vulnerability in Firefox, Thunderbird

During iframe navigation, certain pages did not have their FeaturePolicy fully initialized, resulting in a bypass that allowed device permissions to be leaked into untrusted sub-documents. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...

Astra Linux – Vulnerability in Firefox and Thunderbird

If a custom mouse cursor is specified in CSS, under certain circumstances the cursor might be drawn over the browser UI, potentially causing confusion for users or leading to spoofing attacks. This vulnerability affects Firefox ESR 102.5, Thunderbird 102.5, and Firefox 107...

Astra Linux – Vulnerability in Firefox and Thunderbird

A read operation outside of its bound range could have caused a crash in the RLBox Expat driver. This vulnerability affects Firefox 113, Firefox ESR 102.11, and Thunderbird 102.11...

Astra Linux – Vulnerability in Firefox and Thunderbird

The reordering of instructions resulted in a sequence of instructions that would cause an object to be incorrectly processed during garbage collection. This led to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 78.13, Thunderbird 91, Firefox ESR 78.1...

Astra Linux – Vulnerability in Firefox and Thunderbird

When Responsive Design Mode was enabled, it used references to objects that had previously been freed. We assume that with sufficient effort, this could have been exploited to execute arbitrary code. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Firefox, Thunderbird

If a document creates a sandboxed iframe without allow-scripts, and then appends an element to the iframe’s document that has a JavaScript event handler—the event handler will still be executed despite the iframe being in a sandbox. This vulnerability affects Firefox versions earlier than 97,...

Astra Linux – Vulnerability in Firefox and Thunderbird

Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

A WebGL framebuffer was not initialized early enough, resulting in memory corruption and an out-of-bound write. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

Astra Linux – Vulnerability in Firefox, Thunderbird

Memory safety bugs exist in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability affects Firefox version...

Astra Linux – Vulnerability in Firefox and Thunderbird

A out-of-bounds read could have led to a exploitable crash during HTML parsing using the DOMParser in low-memory situations. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Astra Linux – Vulnerability in Firefox, Thunderbird

DoS attack due to out-of-memory in the Graphics:WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2...

Astra Linux – Vulnerability in Firefox and Thunderbird

Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11...

Astra Linux – Vulnerability in Thunderbird, Firefox

It was possible to cause a use-after-free in the content processing side of a WebTransport connection, resulting in a potentially exploitable crash. This vulnerability has been fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8...

Astra Linux – Vulnerability in Firefox and Thunderbird

The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...

Astra Linux – Vulnerability in Firefox and Thunderbird

Certain types of allocations lacked annotations that, if the Garbage Collector was in a specific state, could have led to memory corruption and potentially exploitable crashes. This vulnerability affects Firefox 106, Firefox ESR 102.4, and Thunderbird 102.4...