SUSE-CU-2026:12020-1: Security update of suse/kiosk/firefox-esr
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Wed Oct 7 08:09:53 UTC 2026
SUSE Container Update Advisory: suse/kiosk/firefox-esr
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12020-1
Container Tags : suse/kiosk/firefox-esr:153.4 , suse/kiosk/firefox-esr:153.4-75.50 , suse/kiosk/firefox-esr:esr , suse/kiosk/firefox-esr:latest
Container Release : 75.50
Severity : important
Type : security
References : 1282929 CVE-2026-100756 CVE-2026-100757 CVE-2026-100758 CVE-2026-100759
CVE-2026-100760 CVE-2026-100762 CVE-2026-100765 CVE-2026-100766
CVE-2026-100767 CVE-2026-100769 CVE-2026-100770 CVE-2026-100771
CVE-2026-100772 CVE-2026-100773 CVE-2026-100774 CVE-2026-100775
CVE-2026-100776 CVE-2026-100777 CVE-2026-100778 CVE-2026-100779
CVE-2026-100780 CVE-2026-100781 CVE-2026-100782 CVE-2026-100783
CVE-2026-100784 CVE-2026-100785 CVE-2026-100786 CVE-2026-100787
CVE-2026-100788 CVE-2026-100789 CVE-2026-100790 CVE-2026-100791
CVE-2026-100792 CVE-2026-100794 CVE-2026-100797 CVE-2026-100798
CVE-2026-100800 CVE-2026-100801 CVE-2026-100803 CVE-2026-100806
CVE-2026-100807 CVE-2026-100808 CVE-2026-100809 CVE-2026-100811
CVE-2026-100812 CVE-2026-100814 CVE-2026-100815 CVE-2026-100816
CVE-2026-100818 CVE-2026-100819 CVE-2026-100820 CVE-2026-100821
CVE-2026-100822 CVE-2026-100824 CVE-2026-100825 CVE-2026-100826
CVE-2026-100828 CVE-2026-100829 CVE-2026-100830 CVE-2026-100831
CVE-2026-100832 CVE-2026-96869
-----------------------------------------------------------------
The container suse/kiosk/firefox-esr was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4545-1
Released: Tue Oct 6 12:02:15 2026
Summary: Security update for MozillaFirefox
Type: security
Severity: important
References: 1282929,CVE-2026-100756,CVE-2026-100757,CVE-2026-100758,CVE-2026-100759,CVE-2026-100760,CVE-2026-100762,CVE-2026-100765,CVE-2026-100766,CVE-2026-100767,CVE-2026-100769,CVE-2026-100770,CVE-2026-100771,CVE-2026-100772,CVE-2026-100773,CVE-2026-100774,CVE-2026-100775,CVE-2026-100776,CVE-2026-100777,CVE-2026-100778,CVE-2026-100779,CVE-2026-100780,CVE-2026-100781,CVE-2026-100782,CVE-2026-100783,CVE-2026-100784,CVE-2026-100785,CVE-2026-100786,CVE-2026-100787,CVE-2026-100788,CVE-2026-100789,CVE-2026-100790,CVE-2026-100791,CVE-2026-100792,CVE-2026-100794,CVE-2026-100797,CVE-2026-100798,CVE-2026-100800,CVE-2026-100801,CVE-2026-100803,CVE-2026-100806,CVE-2026-100807,CVE-2026-100808,CVE-2026-100809,CVE-2026-100811,CVE-2026-100812,CVE-2026-100814,CVE-2026-100815,CVE-2026-100816,CVE-2026-100818,CVE-2026-100819,CVE-2026-100820,CVE-2026-100821,CVE-2026-100822,CVE-2026-100824,CVE-2026-100825,CVE-2026-100826,CVE-2026-100828,CVE-2026-100829,CVE-2026-100830,CVE-2026-100831,CVE-2026-100832,C
VE-2026-96869
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 153.4.0 ESR (MFSA 2026-100, bsc#1282929):
- CVE-2026-96869: Information disclosure in the Networking component.
- CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback component.
- CVE-2026-100757: Use-after-free in the Widget component.
- CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
- CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager component.
- CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content Processes component.
- CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.
- CVE-2026-100766: Information disclosure in the Networking: JAR component.
- CVE-2026-100767: Use-after-free in the Networking: Cache component.
- CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.
- CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content Processes component.
- CVE-2026-100771: Undefined behavior in the DOM: Streams component.
- CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.
- CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-100775: Sandbox escape in the Graphics component.
- CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.
- CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.
- CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
- CVE-2026-100779: Use-after-free in the XSLT component.
- CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.
- CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component.
- CVE-2026-100783: Uninitialized memory in the Audio/Video component.
- CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.
- CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics component.
- CVE-2026-100787: Sandbox escape in the XUL component.
- CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.
- CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.
- CVE-2026-100790: Use-after-free in the XSLT component.
- CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.
- CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component.
- CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the Internationalization component.
- CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics: WebRender component.
- CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.
- CVE-2026-100800: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-100801: Privilege escalation in the DLL Services component.
- CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.
- CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.
- CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.
- CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.
- CVE-2026-100809: Same-origin policy bypass in the DevTools component.
- CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core & HTML component.
- CVE-2026-100812: Denial-of-service in the Graphics component.
- CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component.
- CVE-2026-100816: Site isolation issue in the DOM: Networking component.
- CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk component.
- CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the XPCOM component.
- CVE-2026-100820: Privilege escalation in the Address Bar component.
- CVE-2026-100821: Site isolation issue in the Panning and Zooming component.
- CVE-2026-100822: Spoofing issue in the Networking: HTTP component.
- CVE-2026-100824: Privilege escalation in the Places component.
- CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.
- CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.
- CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.
- CVE-2026-100829: Mitigation bypass in the DOM: Security component.
- CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.
- CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling component.
- CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.
The following package changes have been done:
- MozillaFirefox-153.4.0-150400.157.11.1 updated
More information about the sle-container-updates
mailing list