SUSE-SU-2026:3200-1: critical: Security update for MozillaFirefox

SLE-SECURITY-UPDATES null at suse.de
Thu Jul 23 08:39:01 UTC 2026 

# Security update for MozillaFirefox

Announcement ID: SUSE-SU-2026:3200-1  
Release Date: 2026-07-22T18:48:43Z  
Rating: critical  
References:

  * bsc#1271649

  
Cross-References:

  * CVE-2026-15718
  * CVE-2026-15719
  * CVE-2026-16349
  * CVE-2026-16350
  * CVE-2026-16351
  * CVE-2026-16352
  * CVE-2026-16353
  * CVE-2026-16354
  * CVE-2026-16355
  * CVE-2026-16356
  * CVE-2026-16357
  * CVE-2026-16358
  * CVE-2026-16359
  * CVE-2026-16360
  * CVE-2026-16361
  * CVE-2026-16362
  * CVE-2026-16363
  * CVE-2026-16368
  * CVE-2026-16369
  * CVE-2026-16371
  * CVE-2026-16374
  * CVE-2026-16375
  * CVE-2026-16377
  * CVE-2026-16379
  * CVE-2026-16381
  * CVE-2026-16383
  * CVE-2026-16387
  * CVE-2026-16390
  * CVE-2026-16391
  * CVE-2026-16396
  * CVE-2026-16405
  * CVE-2026-16412

  
CVSS scores:

  * CVE-2026-15718 ( NVD ):  4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
  * CVE-2026-15719 ( NVD ):  5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
  * CVE-2026-16349 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16350 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16351 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16352 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16353 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16354 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16355 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16356 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16357 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16358 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16359 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16360 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16361 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16362 ( NVD ):  8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-16363 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16368 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16369 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16371 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16374 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16375 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16377 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16379 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16381 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16383 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16387 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16390 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-16391 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16396 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-16405 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  * CVE-2026-16412 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  
Affected Products:

  * SUSE Linux Enterprise High Performance Computing 12 SP5
  * SUSE Linux Enterprise Server 12 SP5
  * SUSE Linux Enterprise Server 12 SP5 LTSS
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
  * SUSE Linux Enterprise Server for SAP Applications 12 SP5

  
  
An update that solves 32 vulnerabilities can now be installed.

## Description:

This update for MozillaFirefox fixes the following issues:

  * Firefox Extended Support Release 140.13.0 ESR (MFSA 2026-70, bsc#1271649):

  * CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component.

  * CVE-2026-15719: Site isolation issue in the DOM: Navigation component.
  * CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component.
  * CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb
    component.
  * CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation
    component.
  * CVE-2026-16352: Sandbox escape due to use-after-free in the Disability
    Access APIs component.
  * CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component.
  * CVE-2026-16354: Information disclosure in the Graphics: ImageLib component.
  * CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component.
  * CVE-2026-16356: Sandbox escape due to use-after-free in the Disability
    Access APIs component.
  * CVE-2026-16357: Incorrect boundary conditions in the Graphics component.
  * CVE-2026-16358: Site isolation issue in the Graphics: WebRender component.
  * CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP
    component.
  * CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR
    140.13 and Firefox 153.
  * CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox
    ESR 140.13.
  * CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component.
  * CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component.
  * CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly
    component.
  * CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component.
  * CVE-2026-16371: Privilege escalation in the DOM: Navigation component.
  * CVE-2026-16374: Information disclosure in the Framework component in
    DevTools.
  * CVE-2026-16375: Site isolation issue in the Networking: HTTP component.
  * CVE-2026-16377: Mitigation bypass in the PDF Viewer component.
  * CVE-2026-16379: Privilege escalation in the DOM: Content Processes
    component.
  * CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component.
  * CVE-2026-16383: Mitigation bypass in the DOM: Networking component.
  * CVE-2026-16387: Site isolation issue in the Networking component.
  * CVE-2026-16390: Mitigation bypass in the Enterprise Policies component.
  * CVE-2026-16391: Information disclosure in the Storage: IndexedDB component.
  * CVE-2026-16396: Privilege escalation in WebExtensions.
  * CVE-2026-16405: Information disclosure in the Networking: WebSockets
    component.
  * CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox
    153.

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server 12 SP5 LTSS  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-3200=1

  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security  
    zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3200=1

## Package List:

  * SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
    * MozillaFirefox-translations-common-140.13.0-112.324.2
    * MozillaFirefox-140.13.0-112.324.2
    * MozillaFirefox-debuginfo-140.13.0-112.324.2
    * MozillaFirefox-debugsource-140.13.0-112.324.2
  * SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
    * MozillaFirefox-devel-140.13.0-112.324.2
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
    * MozillaFirefox-translations-common-140.13.0-112.324.2
    * MozillaFirefox-140.13.0-112.324.2
    * MozillaFirefox-debuginfo-140.13.0-112.324.2
    * MozillaFirefox-debugsource-140.13.0-112.324.2
  * SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
    * MozillaFirefox-devel-140.13.0-112.324.2

## References:

  * https://www.suse.com/security/cve/CVE-2026-15718.html
  * https://www.suse.com/security/cve/CVE-2026-15719.html
  * https://www.suse.com/security/cve/CVE-2026-16349.html
  * https://www.suse.com/security/cve/CVE-2026-16350.html
  * https://www.suse.com/security/cve/CVE-2026-16351.html
  * https://www.suse.com/security/cve/CVE-2026-16352.html
  * https://www.suse.com/security/cve/CVE-2026-16353.html
  * https://www.suse.com/security/cve/CVE-2026-16354.html
  * https://www.suse.com/security/cve/CVE-2026-16355.html
  * https://www.suse.com/security/cve/CVE-2026-16356.html
  * https://www.suse.com/security/cve/CVE-2026-16357.html
  * https://www.suse.com/security/cve/CVE-2026-16358.html
  * https://www.suse.com/security/cve/CVE-2026-16359.html
  * https://www.suse.com/security/cve/CVE-2026-16360.html
  * https://www.suse.com/security/cve/CVE-2026-16361.html
  * https://www.suse.com/security/cve/CVE-2026-16362.html
  * https://www.suse.com/security/cve/CVE-2026-16363.html
  * https://www.suse.com/security/cve/CVE-2026-16368.html
  * https://www.suse.com/security/cve/CVE-2026-16369.html
  * https://www.suse.com/security/cve/CVE-2026-16371.html
  * https://www.suse.com/security/cve/CVE-2026-16374.html
  * https://www.suse.com/security/cve/CVE-2026-16375.html
  * https://www.suse.com/security/cve/CVE-2026-16377.html
  * https://www.suse.com/security/cve/CVE-2026-16379.html
  * https://www.suse.com/security/cve/CVE-2026-16381.html
  * https://www.suse.com/security/cve/CVE-2026-16383.html
  * https://www.suse.com/security/cve/CVE-2026-16387.html
  * https://www.suse.com/security/cve/CVE-2026-16390.html
  * https://www.suse.com/security/cve/CVE-2026-16391.html
  * https://www.suse.com/security/cve/CVE-2026-16396.html
  * https://www.suse.com/security/cve/CVE-2026-16405.html
  * https://www.suse.com/security/cve/CVE-2026-16412.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1271649

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260723/f7a7a4a3/attachment.htm>

More information about the sle-security-updates mailing list