{"id":"MGASA-2026-0582","summary":"Updated firefox, firefox-l10n, nss packages fix security vulnerabilities","details":"The updated packages fix security vulnerabilities:\nSame-origin policy bypass in the DOM: Navigation component.\n(CVE-2026-117860)\nSandbox escape in the DOM: Navigation component. (CVE-2026-117861)\nPrivilege escalation due to incorrect boundary conditions in the\nNetworking component. (CVE-2026-117862)\nInformation disclosure due to uninitialized memory in the Audio/Video\ncomponent. (CVE-2026-117863)\nSandbox escape in the Form Manager component. (CVE-2026-117864)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117865)\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D\ncomponent. (CVE-2026-117866)\nUse-after-free in the Layout component. (CVE-2026-117867)\nSandbox escape in the DOM: Networking component. (CVE-2026-117868)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117869)\nUse-after-free in the JavaScript Engine component. (CVE-2026-117870)\nInvalid pointer in the Graphics component. (CVE-2026-117871)\nUse-after-free in the JavaScript: Standard Library component.\n(CVE-2026-117872)\nIncorrect boundary conditions in the Audio/Video: Playback component.\n(CVE-2026-117873)\nUse-after-free in the Internationalization component. (CVE-2026-117874)\nUse-after-free in the Layout: Scrolling and Overflow component.\n(CVE-2026-117875)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117876)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117877)\nOther issue, use-after-free in the Storage: IndexedDB component.\n(CVE-2026-117878)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117879)\nUse-after-free in the XML component. (CVE-2026-117880)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117881)\nUse-after-free in the Layout component. (CVE-2026-117882)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117883)\nUse-after-free in the Networking component. (CVE-2026-117884)\nUse-after-free in the Layout: Grid component. (CVE-2026-117885)\nIncorrect boundary conditions in the Graphics: Text component.\n(CVE-2026-117886)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117887)\nUninitialized memory in the Graphics: Canvas2D component.\n(CVE-2026-117888)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117889)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-117890)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117891)\nPrivilege escalation due to use-after-free in the WebRTC: Networking\ncomponent. (CVE-2026-117892)\nIncorrect boundary conditions in the Security: PSM component.\n(CVE-2026-117893)\nIncorrect boundary conditions in the WebRTC: Signaling component.\n(CVE-2026-117894)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117895)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117896)\nIncorrect boundary conditions in the Layout: Tables component.\n(CVE-2026-117897)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-117898)\nUse-after-free in the Networking: HTTP component. (CVE-2026-117899)\nUse-after-free in the DOM: Editor component. (CVE-2026-117900)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117901)\nUse-after-free in the Layout: Text and Fonts component.\n(CVE-2026-117902)\nUse-after-free in the Audio/Video component. (CVE-2026-117903)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117904)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117905)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117906)\nUse-after-free in the Networking component. (CVE-2026-117907)\nUse-after-free in the Graphics: ImageLib component. (CVE-2026-117908)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117909)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117910)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-117911)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117912)\nUse-after-free in the SVG component. (CVE-2026-117913)\nUse-after-free in the SVG component. (CVE-2026-117914)\nIncorrect boundary conditions in the Layout: Block and Inline component.\n(CVE-2026-117915)\nUse-after-free in the XSLT component. (CVE-2026-117916)\nInvalid pointer in the Graphics: WebRender component. (CVE-2026-117917)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-117918)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117919)\nUse-after-free in the DOM: HTML Parser component. (CVE-2026-117920)\nUse-after-free in the CSS Parsing and Computation component.\n(CVE-2026-117921)\nUse-after-free in the Networking: WebSockets component.\n(CVE-2026-117922)\nUse-after-free in the Audio/Video component. (CVE-2026-117923)\nUse-after-free in the XSLT component. (CVE-2026-117924)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117925)\nIncorrect boundary conditions in the SVG component. (CVE-2026-117926)\nUse-after-free in the SVG component. (CVE-2026-117927)\nSame-origin policy bypass in the CSS Parsing and Computation component.\n(CVE-2026-117928)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117929)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117930)\nUse-after-free in the DOM: Events component. (CVE-2026-117931)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117932)\nFrame poisoning in the CSS Parsing and Computation component.\n(CVE-2026-117933)\nUse-after-free in the Layout component. (CVE-2026-117934)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-117935)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117936)\nInvalid pointer in the JavaScript Engine component. (CVE-2026-117937)\nUse-after-free in the Layout component. (CVE-2026-117938)\nUse-after-free in the XML component. (CVE-2026-117939)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117940)\nUse-after-free in the DOM: CSS Object Model component. (CVE-2026-117941)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-117942)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117943)\nUse-after-free in the Layout component. (CVE-2026-117944)\nIncorrect boundary conditions in the XML component. (CVE-2026-117945)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-117946)\nUse-after-free in the XML component. (CVE-2026-117947)\nUse-after-free in the SVG component. (CVE-2026-117948)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117949)\nIncorrect boundary conditions in the DOM: Core & HTML component.\n(CVE-2026-117950)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117951)\nUninitialized memory in the Networking component. (CVE-2026-117952)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117953)\nUse-after-free in the Layout: Positioned component. (CVE-2026-117954)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-117955)\nPrivilege escalation in the DLL Services component. (CVE-2026-100801)\nInvalid pointer in the Nimbus Desktop Client component.\n(CVE-2026-117956)\nCryptographic issue in the WebRTC: Networking component.\n(CVE-2026-117957)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117958)\nSite isolation issue in the DOM: Service Workers component.\n(CVE-2026-117959)\nSpoofing issue in the DOM: Core & HTML component. (CVE-2026-117960)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117961)\nSandbox escape due to incorrect boundary conditions in the Storage:\nQuota Manager component. (CVE-2026-117962)\nIncorrect boundary conditions in the DOM: Service Workers component.\n(CVE-2026-117963)\nUse-after-free in the Panning and Zooming component. (CVE-2026-117964)\nSame-origin policy bypass in the Address Bar component.\n(CVE-2026-117965)\nSite isolation issue in the Networking: HTTP component.\n(CVE-2026-117966)\nMitigation bypass in the DOM: Security component. (CVE-2026-117967)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-117968)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117969)\nRace condition in the Disability Access APIs component.\n(CVE-2026-117970)\nSandbox escape due to use-after-free in the Print Preview component.\n(CVE-2026-117971)\nUse-after-free in the Graphics component. (CVE-2026-117972)\nUse-after-free in the Networking: DNS component. (CVE-2026-117973)\nUse-after-free in the XML component. (CVE-2026-117974)\nSandbox escape due to invalid pointer in the Graphics: WebRender\ncomponent. (CVE-2026-117975)\nSite isolation issue in the DOM: Navigation component. (CVE-2026-117976)\nOther issue in the Console component. (CVE-2026-117977)\nIncorrect boundary conditions in the Graphics component.\n(CVE-2026-117978)\nIncorrect boundary conditions in the Graphics: WebRender component.\n(CVE-2026-117979)\nUse-after-free in the Graphics component. (CVE-2026-117980)\nPrivilege escalation in the Toolkit component. (CVE-2026-117981)\nInvalid pointer in the JavaScript Engine: JIT component.\n(CVE-2026-117982)\nUse-after-free in the Graphics component. (CVE-2026-117983)\nIncorrect boundary conditions in the Layout: Scrolling and Overflow\ncomponent. (CVE-2026-117984)\nSandbox escape due to use-after-free in the Graphics component.\n(CVE-2026-117985)\nUse-after-free in the Graphics component. (CVE-2026-117986)\nUse-after-free in the Graphics component. (CVE-2026-117987)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nCanvasWebGL component. (CVE-2026-117988)\nUse-after-free in the Graphics component. (CVE-2026-117989)\nSandbox escape due to incorrect boundary conditions in the Graphics:\nWebRender component. (CVE-2026-117990)\nIncorrect boundary conditions in the Layout: Text and Fonts component.\n(CVE-2026-117991)\nInformation disclosure in the CSS Parsing and Computation component.\n(CVE-2026-117992)\nInteger overflow in the Graphics: Text component. (CVE-2026-117993)\nUse-after-free in the JavaScript: GC component. (CVE-2026-117994)\nPrivilege escalation in the DOM: UI Events & Focus Handling component.\n(CVE-2026-117995)\nIncorrect boundary conditions in the WebRTC component. (CVE-2026-117996)\nSandbox escape due to use-after-free in the Widget component.\n(CVE-2026-117997)\nMitigation bypass in the DOM: Push Subscriptions component.\n(CVE-2026-117998)\nRace condition in the IPC component. (CVE-2026-117999)\nInformation disclosure in the Networking: HTTP component.\n(CVE-2026-118000)\nInformation disclosure due to race condition in the Networking\ncomponent. (CVE-2026-118002)\nInformation disclosure in the Networking: DNS component.\n(CVE-2026-118003)\nIncorrect boundary conditions in the CSS Transitions and Animations\ncomponent. (CVE-2026-118004)\n","modified":"2026-11-09T16:58:25.506864270Z","published":"2026-11-09T16:32:57Z","upstream":["CVE-2026-100801","CVE-2026-117860","CVE-2026-117861","CVE-2026-117862","CVE-2026-117863","CVE-2026-117864","CVE-2026-117865","CVE-2026-117866","CVE-2026-117867","CVE-2026-117868","CVE-2026-117869","CVE-2026-117870","CVE-2026-117871","CVE-2026-117872","CVE-2026-117873","CVE-2026-117874","CVE-2026-117875","CVE-2026-117876","CVE-2026-117877","CVE-2026-117878","CVE-2026-117879","CVE-2026-117880","CVE-2026-117881","CVE-2026-117882","CVE-2026-117883","CVE-2026-117884","CVE-2026-117885","CVE-2026-117886","CVE-2026-117887","CVE-2026-117888","CVE-2026-117889","CVE-2026-117890","CVE-2026-117891","CVE-2026-117892","CVE-2026-117893","CVE-2026-117894","CVE-2026-117895","CVE-2026-117896","CVE-2026-117897","CVE-2026-117898","CVE-2026-117899","CVE-2026-117900","CVE-2026-117901","CVE-2026-117902","CVE-2026-117903","CVE-2026-117904","CVE-2026-117905","CVE-2026-117906","CVE-2026-117907","CVE-2026-117908","CVE-2026-117909","CVE-2026-117910","CVE-2026-117911","CVE-2026-117912","CVE-2026-117913","CVE-2026-117914","CVE-2026-117915","CVE-2026-117916","CVE-2026-117917","CVE-2026-117918","CVE-2026-117919","CVE-2026-117920","CVE-2026-117921","CVE-2026-117922","CVE-2026-117923","CVE-2026-117924","CVE-2026-117925","CVE-2026-117926","CVE-2026-117927","CVE-2026-117928","CVE-2026-117929","CVE-2026-117930","CVE-2026-117931","CVE-2026-117932","CVE-2026-117933","CVE-2026-117934","CVE-2026-117935","CVE-2026-117936","CVE-2026-117937","CVE-2026-117938","CVE-2026-117939","CVE-2026-117940","CVE-2026-117941","CVE-2026-117942","CVE-2026-117943","CVE-2026-117944","CVE-2026-117945","CVE-2026-117946","CVE-2026-117947","CVE-2026-117948","CVE-2026-117949","CVE-2026-117950","CVE-2026-117951","CVE-2026-117952","CVE-2026-117953","CVE-2026-117954","CVE-2026-117955","CVE-2026-117956","CVE-2026-117957","CVE-2026-117958","CVE-2026-117959","CVE-2026-117960","CVE-2026-117961","CVE-2026-117962","CVE-2026-117963","CVE-2026-117964","CVE-2026-117965","CVE-2026-117966","CVE-2026-117967","CVE-2026-117968","CVE-2026-117969","CVE-2026-117970","CVE-2026-117971","CVE-2026-117972","CVE-2026-117973","CVE-2026-117974","CVE-2026-117975","CVE-2026-117976","CVE-2026-117977","CVE-2026-117978","CVE-2026-117979","CVE-2026-117980","CVE-2026-117981","CVE-2026-117982","CVE-2026-117983","CVE-2026-117984","CVE-2026-117985","CVE-2026-117986","CVE-2026-117987","CVE-2026-117988","CVE-2026-117989","CVE-2026-117990","CVE-2026-117991","CVE-2026-117992","CVE-2026-117993","CVE-2026-117994","CVE-2026-117995","CVE-2026-117996","CVE-2026-117997","CVE-2026-117998","CVE-2026-117999","CVE-2026-118000","CVE-2026-118002","CVE-2026-118003","CVE-2026-118004"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0582.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36592"},{"type":"WEB","url":"https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_132.html"},{"type":"WEB","url":"https://www.firefox.com/en-US/firefox/153.6.0/releasenotes/"},{"type":"ADVISORY","url":"https://www.mozilla.org/en-US/security/advisories/mfsa2026-120/"}],"affected":[{"package":{"name":"firefox","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/firefox?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0582.json"}},{"package":{"name":"firefox-l10n","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/firefox-l10n?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"153.6.0-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0582.json"}},{"package":{"name":"nss","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/nss?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.132.0-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0582.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}