{"id":"RLSA-2026:99111","summary":"Important: firefox security update","details":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-118007)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the XPCOM component (CVE-2026-118021)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-118024)\n\n* firefox: thunderbird: Race condition, use-after-free in the DOM: File component (CVE-2026-118019)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124860)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-124914)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124869)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-124854)\n\n* firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-124877)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component (CVE-2026-124917)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: Selection component (CVE-2026-124891)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-124857)\n\n* firefox: thunderbird: Information disclosure in the Security: RLBox component (CVE-2026-124941)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124855)\n\n* firefox: thunderbird: Spoofing issue in the Security component (CVE-2026-124934)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component (CVE-2026-124853)\n\n* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-124905)\n\n* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component (CVE-2026-124859)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124881)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124862)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124882)\n\n* firefox: thunderbird: Information disclosure in the Private Browsing component (CVE-2026-124909)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124876)\n\n* firefox: thunderbird: Use-after-free in the DOM: Workers component (CVE-2026-124893)\n\n* firefox: thunderbird: Use-after-free in the Graphics: WebRender component (CVE-2026-124906)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124887)\n\n* firefox: thunderbird: Mitigation bypass in the WebExtensions component (CVE-2026-124910)\n\n* firefox: thunderbird: Privilege escalation in the Nimbus Desktop Client component (CVE-2026-124951)\n\n* firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-124865)\n\n* firefox: thunderbird: Incorrect boundary conditions, use-after-free in the Graphics component (CVE-2026-124948)\n\n* firefox: thunderbird: Undefined behavior in the WebRTC: Networking component (CVE-2026-124935)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: CSS Object Model component (CVE-2026-124875)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the IPC component (CVE-2026-124903)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Networking: HTTP component (CVE-2026-124856)\n\n* firefox: thunderbird: Use-after-free in the Networking: Cookies component (CVE-2026-124894)\n\n* firefox: thunderbird: Use-after-free in the Storage: localStorage & sessionStorage component (CVE-2026-124895)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-124885)\n\n* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-124899)\n\n* firefox: thunderbird: Sandbox escape in the Console component (CVE-2026-124933)\n\n* firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-124866)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124883)\n\n* firefox: thunderbird: Information disclosure in the Layout: Form Controls component (CVE-2026-124929)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2026-124870)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-124927)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebGPU component (CVE-2026-124915)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124890)\n\n* firefox: thunderbird: Information disclosure in the Address Bar component (CVE-2026-124930)\n\n* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124886)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124858)\n\n* firefox: thunderbird: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component (CVE-2026-124907)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Editor component (CVE-2026-124873)\n\n* firefox: thunderbird: Spoofing issue in the DOM: Security component (CVE-2026-124912)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-124874)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124892)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Streams component (CVE-2026-124942)\n\n* firefox: thunderbird: Use-after-free in the CSS Transitions and Animations component (CVE-2026-124922)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124918)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124884)\n\n* firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-124868)\n\n* firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component (CVE-2026-124919)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-124924)\n\n* firefox: thunderbird: Same-origin policy bypass due to race condition in the Audio/Video component (CVE-2026-124902)\n\n* firefox: thunderbird: Invalid pointer in the Networking: Cache component (CVE-2026-124879)\n\n* firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-124932)\n\n* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-124940)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Core & HTML component (CVE-2026-124931)\n\n* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-124926)\n\n* firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-124863)\n\n* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-124889)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-124913)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-124897)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Service Workers component (CVE-2026-124864)\n\n* firefox: thunderbird: Use-after-free in the Cycle Collector component (CVE-2026-124872)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-124880)\n\n* firefox: thunderbird: Invalid pointer in the Layout: Text and Fonts component (CVE-2026-124896)\n\n* firefox: thunderbird: Other issue in the Networking: JAR component (CVE-2026-124901)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-124888)\n\n* firefox: thunderbird: Mitigation bypass in the Add-ons Manager component (CVE-2026-124938)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Audio/Video: cubeb component (CVE-2026-124861)\n\n* firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-124898)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-124939)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","modified":"2026-11-13T12:45:14.981688869Z","published":"2026-11-13T12:04:43.442503Z","upstream":["CVE-2026-118007","CVE-2026-118019","CVE-2026-118021","CVE-2026-118024","CVE-2026-124853","CVE-2026-124854","CVE-2026-124855","CVE-2026-124856","CVE-2026-124857","CVE-2026-124858","CVE-2026-124859","CVE-2026-124860","CVE-2026-124861","CVE-2026-124862","CVE-2026-124863","CVE-2026-124864","CVE-2026-124865","CVE-2026-124866","CVE-2026-124868","CVE-2026-124869","CVE-2026-124870","CVE-2026-124872","CVE-2026-124873","CVE-2026-124874","CVE-2026-124875","CVE-2026-124876","CVE-2026-124877","CVE-2026-124879","CVE-2026-124880","CVE-2026-124881","CVE-2026-124882","CVE-2026-124883","CVE-2026-124884","CVE-2026-124885","CVE-2026-124886","CVE-2026-124887","CVE-2026-124888","CVE-2026-124889","CVE-2026-124890","CVE-2026-124891","CVE-2026-124892","CVE-2026-124893","CVE-2026-124894","CVE-2026-124895","CVE-2026-124896","CVE-2026-124897","CVE-2026-124898","CVE-2026-124899","CVE-2026-124901","CVE-2026-124902","CVE-2026-124903","CVE-2026-124905","CVE-2026-124906","CVE-2026-124907","CVE-2026-124909","CVE-2026-124910","CVE-2026-124912","CVE-2026-124913","CVE-2026-124914","CVE-2026-124915","CVE-2026-124917","CVE-2026-124918","CVE-2026-124919","CVE-2026-124922","CVE-2026-124924","CVE-2026-124926","CVE-2026-124927","CVE-2026-124929","CVE-2026-124930","CVE-2026-124931","CVE-2026-124932","CVE-2026-124933","CVE-2026-124934","CVE-2026-124935","CVE-2026-124938","CVE-2026-124939","CVE-2026-124940","CVE-2026-124941","CVE-2026-124942","CVE-2026-124948","CVE-2026-124951"],"database_specific":{"license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","source_advisory":"RHSA-2026:99111"},"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:99111"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562015"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562042"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562122"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2562259"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569830"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569846"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569877"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569907"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569955"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569957"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569970"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569978"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569982"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569985"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2569994"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570012"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570014"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570100"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570107"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570116"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570127"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570137"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570140"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570149"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570165"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570172"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570208"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570241"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570248"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570255"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570306"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570334"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570365"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570417"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570433"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570440"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570491"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570514"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570521"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570548"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570574"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570589"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570601"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570629"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570636"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570644"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570655"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570660"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570662"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570664"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570686"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570704"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570705"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570717"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570726"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570740"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570753"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570755"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570770"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570787"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570811"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570824"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570865"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570876"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570896"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570942"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2570955"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571008"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571031"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571052"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571076"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571102"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571104"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571112"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571117"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571125"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571126"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571146"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571158"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571162"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:99111"}],"affected":[{"package":{"name":"firefox","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debuginfo","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debugsource","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-x11","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-x11?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debuginfo","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debugsource","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-x11","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-x11?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debuginfo","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debugsource","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-x11","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-x11?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debuginfo","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debuginfo?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-debugsource","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-debugsource?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}},{"package":{"name":"firefox-x11","ecosystem":"Rocky Linux:9","purl":"pkg:rpm/rocky-linux/firefox-x11?distro=rocky-linux-9&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:153.7.0-1.el9_9"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2026:99111.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}