SUSE-CU-2026:14260-1: Security update of suse/kiosk/firefox-esr

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Sat Nov 14 09:01:40 UTC 2026 

SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14260-1
Container Tags        : suse/kiosk/firefox-esr:153.7 , suse/kiosk/firefox-esr:153.7-75.71 , suse/kiosk/firefox-esr:esr , suse/kiosk/firefox-esr:latest
Container Release     : 75.71
Severity              : important
Type                  : security
References            : 1289275 CVE-2026-118007 CVE-2026-118019 CVE-2026-118021 CVE-2026-118024
                        CVE-2026-124853 CVE-2026-124854 CVE-2026-124855 CVE-2026-124856
                        CVE-2026-124857 CVE-2026-124858 CVE-2026-124859 CVE-2026-124860
                        CVE-2026-124861 CVE-2026-124862 CVE-2026-124863 CVE-2026-124864
                        CVE-2026-124865 CVE-2026-124866 CVE-2026-124868 CVE-2026-124869
                        CVE-2026-124870 CVE-2026-124872 CVE-2026-124873 CVE-2026-124874
                        CVE-2026-124875 CVE-2026-124876 CVE-2026-124877 CVE-2026-124879
                        CVE-2026-124880 CVE-2026-124881 CVE-2026-124882 CVE-2026-124883
                        CVE-2026-124884 CVE-2026-124885 CVE-2026-124886 CVE-2026-124887
                        CVE-2026-124888 CVE-2026-124889 CVE-2026-124890 CVE-2026-124891
                        CVE-2026-124892 CVE-2026-124893 CVE-2026-124894 CVE-2026-124895
                        CVE-2026-124896 CVE-2026-124897 CVE-2026-124898 CVE-2026-124899
                        CVE-2026-124901 CVE-2026-124902 CVE-2026-124903 CVE-2026-124905
                        CVE-2026-124906 CVE-2026-124907 CVE-2026-124909 CVE-2026-124910
                        CVE-2026-124912 CVE-2026-124913 CVE-2026-124914 CVE-2026-124915
                        CVE-2026-124917 CVE-2026-124918 CVE-2026-124919 CVE-2026-124922
                        CVE-2026-124924 CVE-2026-124926 CVE-2026-124927 CVE-2026-124929
                        CVE-2026-124930 CVE-2026-124931 CVE-2026-124932 CVE-2026-124933
                        CVE-2026-124934 CVE-2026-124935 CVE-2026-124938 CVE-2026-124939
                        CVE-2026-124940 CVE-2026-124941 CVE-2026-124942 CVE-2026-124948
                        CVE-2026-124951 
-----------------------------------------------------------------

The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5229-1
Released:    Fri Nov 13 09:03:38 2026
Summary:     Security update for MozillaFirefox
Type:        security
Severity:    important
References:  1289275,CVE-2026-118007,CVE-2026-118019,CVE-2026-118021,CVE-2026-118024,CVE-2026-124853,CVE-2026-124854,CVE-2026-124855,CVE-2026-124856,CVE-2026-124857,CVE-2026-124858,CVE-2026-124859,CVE-2026-124860,CVE-2026-124861,CVE-2026-124862,CVE-2026-124863,CVE-2026-124864,CVE-2026-124865,CVE-2026-124866,CVE-2026-124868,CVE-2026-124869,CVE-2026-124870,CVE-2026-124872,CVE-2026-124873,CVE-2026-124874,CVE-2026-124875,CVE-2026-124876,CVE-2026-124877,CVE-2026-124879,CVE-2026-124880,CVE-2026-124881,CVE-2026-124882,CVE-2026-124883,CVE-2026-124884,CVE-2026-124885,CVE-2026-124886,CVE-2026-124887,CVE-2026-124888,CVE-2026-124889,CVE-2026-124890,CVE-2026-124891,CVE-2026-124892,CVE-2026-124893,CVE-2026-124894,CVE-2026-124895,CVE-2026-124896,CVE-2026-124897,CVE-2026-124898,CVE-2026-124899,CVE-2026-124901,CVE-2026-124902,CVE-2026-124903,CVE-2026-124905,CVE-2026-124906,CVE-2026-124907,CVE-2026-124909,CVE-2026-124910,CVE-2026-124912,CVE-2026-124913,CVE-2026-124914,CVE-2026-124915,CVE-2026-124917,C
 VE-2026-124918,CVE-2026-124919,CVE-2026-124922,CVE-2026-124924,CVE-2026-124926,CVE-2026-124927,CVE-2026-124929,CVE-2026-124930,CVE-2026-124931,CVE-2026-124932,CVE-2026-124933,CVE-2026-124934,CVE-2026-124935,CVE-2026-124938,CVE-2026-124939,CVE-2026-124940,CVE-2026-124941,CVE-2026-124942,CVE-2026-124948,CVE-2026-124951
This update for MozillaFirefox fixes the following issues:

Update to Firefox Extended Support Release 153.7.0 ESR (MFSA 2026-127, bsc#1289275):

- CVE-2026-118007: Use-after-free in the JavaScript: GC component.
- CVE-2026-118019: Race condition, use-after-free in the DOM: File component.
- CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component.
- CVE-2026-118024: Use-after-free in the Graphics: Text component.
- CVE-2026-124853: Sandbox escape due to incorrect boundary conditions in the Graphics: Text component.
- CVE-2026-124854: Privilege escalation in the DOM: Navigation component.
- CVE-2026-124855: Sandbox escape in the DOM: Navigation component.
- CVE-2026-124856: Incorrect boundary conditions in the Networking: HTTP component.
- CVE-2026-124857: Use-after-free in the Graphics: Canvas2D component.
- CVE-2026-124858: Use-after-free in the DOM: HTML Parser component.
- CVE-2026-124859: Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component.
- CVE-2026-124860: Use-after-free in the Audio/Video component.
- CVE-2026-124861: Sandbox escape due to use-after-free in the Audio/Video: cubeb component.
- CVE-2026-124862: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-124863: Use-after-free in the DOM: HTML Parser component.
- CVE-2026-124864: Sandbox escape due to use-after-free in the DOM: Service Workers component.
- CVE-2026-124865: Use-after-free in the Audio/Video component.
- CVE-2026-124866: Use-after-free in the Layout component.
- CVE-2026-124868: Incorrect boundary conditions in the DOM: Core & HTML component.
- CVE-2026-124869: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-124870: Incorrect boundary conditions in the JavaScript: GC component.
- CVE-2026-124872: Use-after-free in the Cycle Collector component.
- CVE-2026-124873: Invalid pointer in the DOM: Editor component.
- CVE-2026-124874: Same-origin policy bypass in the Networking: HTTP component.
- CVE-2026-124875: Incorrect boundary conditions in the DOM: CSS Object Model component.
- CVE-2026-124876: Use-after-free in the CSS Parsing and Computation component.
- CVE-2026-124877: Use-after-free in the Layout: Positioned component.
- CVE-2026-124879: Invalid pointer in the Networking: Cache component.
- CVE-2026-124880: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-124881: Use-after-free in the CSS Parsing and Computation component.
- CVE-2026-124882: Use-after-free in the CSS Parsing and Computation component.
- CVE-2026-124883: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-124884: Use-after-free in the JavaScript: GC component.
- CVE-2026-124885: Use-after-free in the Graphics: Text component.
- CVE-2026-124886: Invalid pointer in the Layout: Text and Fonts component.
- CVE-2026-124887: Incorrect boundary conditions in the Layout: Text and Fonts component.
- CVE-2026-124888: Incorrect boundary conditions in the Layout: Text and Fonts component.
- CVE-2026-124889: Use-after-free in the CSS Parsing and Computation component.
- CVE-2026-124890: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-124891: Incorrect boundary conditions in the DOM: Selection component.
- CVE-2026-124892: Use-after-free in the JavaScript: GC component.
- CVE-2026-124893: Use-after-free in the DOM: Workers component.
- CVE-2026-124894: Use-after-free in the Networking: Cookies component.
- CVE-2026-124895: Use-after-free in the Storage: localStorage & sessionStorage component.
- CVE-2026-124896: Invalid pointer in the Layout: Text and Fonts component.
- CVE-2026-124897: Use-after-free in the JavaScript: GC component.
- CVE-2026-124898: Use-after-free in the DOM: Editor component.
- CVE-2026-124899: Use-after-free in the Layout: Text and Fonts component.
- CVE-2026-124901: Other issue in the Networking: JAR component.
- CVE-2026-124902: Same-origin policy bypass due to race condition in the Audio/Video component.
- CVE-2026-124903: Sandbox escape due to use-after-free in the IPC component.
- CVE-2026-124905: Sandbox escape in the DOM: Navigation component.
- CVE-2026-124906: Use-after-free in the Graphics: WebRender component.
- CVE-2026-124907: Privilege escalation, sandbox escape due to use-after-free in the Graphics: CanvasWebGL component.
- CVE-2026-124909: Information disclosure in the Private Browsing component.
- CVE-2026-124910: Mitigation bypass in the WebExtensions component.
- CVE-2026-124912: Spoofing issue in the DOM: Security component.
- CVE-2026-124913: Site isolation issue in the Networking component.
- CVE-2026-124914: Site isolation issue in the DOM: Navigation component.
- CVE-2026-124915: Incorrect boundary conditions in the Graphics: WebGPU component.
- CVE-2026-124917: Sandbox escape due to use-after-free in the Widget: Gtk component.
- CVE-2026-124918: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component.
- CVE-2026-124919: Privilege escalation due to use-after-free in the WebRTC: Networking component.
- CVE-2026-124922: Use-after-free in the CSS Transitions and Animations component.
- CVE-2026-124924: Incorrect boundary conditions in the Graphics: WebRender component.
- CVE-2026-124926: Incorrect boundary conditions in the WebRTC component.
- CVE-2026-124927: Site isolation issue in the Graphics: WebRender component.
- CVE-2026-124929: Information disclosure in the Layout: Form Controls component.
- CVE-2026-124930: Information disclosure in the Address Bar component.
- CVE-2026-124931: Same-origin policy bypass in the DOM: Core & HTML component.
- CVE-2026-124932: Use-after-free in the Graphics component.
- CVE-2026-124933: Sandbox escape in the Console component.
- CVE-2026-124934: Spoofing issue in the Security component.
- CVE-2026-124935: Undefined behavior in the WebRTC: Networking component.
- CVE-2026-124938: Mitigation bypass in the Add-ons Manager component.
- CVE-2026-124939: JIT miscompilation in the JavaScript Engine: JIT component.
- CVE-2026-124940: Mitigation bypass in the File Handling component.
- CVE-2026-124941: Information disclosure in the Security: RLBox component.
- CVE-2026-124942: Invalid pointer in the DOM: Streams component.
- CVE-2026-124948: Incorrect boundary conditions, use-after-free in the Graphics component.
- CVE-2026-124951: Privilege escalation in the Nimbus Desktop Client component.


The following package changes have been done:

- MozillaFirefox-153.7.0-150400.157.22.1 updated
- container:suse-sle15-15.7-8d2c3965d4a2275a783f5702ec2e9456f37e0f8b879ffd69e9e57c87991e4a1c-0 updated

More information about the sle-container-updates mailing list