SUSE-SU-2026:23981-1: important: Security update for MozillaFirefox
SLE-SECURITY-UPDATES
null at suse.de
Mon Oct 5 08:44:13 UTC 2026
# Security update for MozillaFirefox
Announcement ID: SUSE-SU-2026:23981-1
Release Date: 2026-09-30T13:07:26Z
Rating: important
References:
* bsc#1282929
Cross-References:
* CVE-2026-100756
* CVE-2026-100757
* CVE-2026-100758
* CVE-2026-100759
* CVE-2026-100760
* CVE-2026-100762
* CVE-2026-100765
* CVE-2026-100766
* CVE-2026-100767
* CVE-2026-100769
* CVE-2026-100770
* CVE-2026-100771
* CVE-2026-100772
* CVE-2026-100773
* CVE-2026-100774
* CVE-2026-100775
* CVE-2026-100776
* CVE-2026-100777
* CVE-2026-100778
* CVE-2026-100779
* CVE-2026-100780
* CVE-2026-100781
* CVE-2026-100782
* CVE-2026-100783
* CVE-2026-100784
* CVE-2026-100785
* CVE-2026-100786
* CVE-2026-100787
* CVE-2026-100788
* CVE-2026-100789
* CVE-2026-100790
* CVE-2026-100791
* CVE-2026-100792
* CVE-2026-100794
* CVE-2026-100797
* CVE-2026-100798
* CVE-2026-100800
* CVE-2026-100801
* CVE-2026-100803
* CVE-2026-100806
* CVE-2026-100807
* CVE-2026-100808
* CVE-2026-100809
* CVE-2026-100811
* CVE-2026-100812
* CVE-2026-100814
* CVE-2026-100815
* CVE-2026-100816
* CVE-2026-100818
* CVE-2026-100819
* CVE-2026-100820
* CVE-2026-100821
* CVE-2026-100822
* CVE-2026-100824
* CVE-2026-100825
* CVE-2026-100826
* CVE-2026-100828
* CVE-2026-100829
* CVE-2026-100830
* CVE-2026-100831
* CVE-2026-100832
* CVE-2026-96869
CVSS scores:
* CVE-2026-100756 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100757 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100758 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100759 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100760 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100762 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100765 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100766 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-100767 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100769 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100770 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100771 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100772 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100773 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100774 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100775 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100776 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100777 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100778 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100779 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100780 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100781 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100782 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100783 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-100784 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100785 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100786 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100787 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100788 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-100789 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100790 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100791 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100792 ( NVD ): 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
* CVE-2026-100794 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100797 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100798 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100800 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100801 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100803 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100806 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
* CVE-2026-100807 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100808 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100809 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100811 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100812 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-100814 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100815 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100816 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100818 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100819 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100820 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100821 ( NVD ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
* CVE-2026-100822 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
* CVE-2026-100824 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100825 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100826 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
* CVE-2026-100828 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100829 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
* CVE-2026-100830 ( NVD ): 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
* CVE-2026-100831 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-100832 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-96869 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP applications 16.0
An update that solves 62 vulnerabilities can now be installed.
## Description:
This update for MozillaFirefox fixes the following issues:
Update to Firefox Extended Support Release 153.4.0 ESR (MFSA 2026-100,
bsc#1282929):
* CVE-2026-96869: Information disclosure in the Networking component.
* CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback
component.
* CVE-2026-100757: Use-after-free in the Widget component.
* CVE-2026-100758: Sandbox escape in the DOM: Navigation component.
* CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager
component.
* CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing
component.
* CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
Processes component.
* CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100766: Information disclosure in the Networking: JAR component.
* CVE-2026-100767: Use-after-free in the Networking: Cache component.
* CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
Processes component.
* CVE-2026-100771: Undefined behavior in the DOM: Streams component.
* CVE-2026-100772: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100773: Use-after-free in the Storage: IndexedDB component.
* CVE-2026-100774: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100775: Sandbox escape in the Graphics component.
* CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component.
* CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core &
HTML component.
* CVE-2026-100779: Use-after-free in the XSLT component.
* CVE-2026-100780: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component.
* CVE-2026-100782: Privilege escalation due to incorrect boundary conditions
in the Graphics component.
* CVE-2026-100783: Uninitialized memory in the Audio/Video component.
* CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component.
* CVE-2026-100785: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
component.
* CVE-2026-100787: Sandbox escape in the XUL component.
* CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component.
* CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component.
* CVE-2026-100790: Use-after-free in the XSLT component.
* CVE-2026-100791: Use-after-free in the DOM: Core & HTML component.
* CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly
component.
* CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the
Internationalization component.
* CVE-2026-100797: Privilege escalation due to use-after-free in the Graphics:
WebRender component.
* CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component.
* CVE-2026-100800: Sandbox escape due to use-after-free in the Disability
Access APIs component.
* CVE-2026-100801: Privilege escalation in the DLL Services component.
* CVE-2026-100803: Same-origin policy bypass in the WebExtensions component.
* CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component.
* CVE-2026-100807: Privilege escalation in the DOM: Service Workers component.
* CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component.
* CVE-2026-100809: Same-origin policy bypass in the DevTools component.
* CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core &
HTML component.
* CVE-2026-100812: Denial-of-service in the Graphics component.
* CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine: JIT
component.
* CVE-2026-100815: Use-after-free in the CSS Parsing and Computation
component.
* CVE-2026-100816: Site isolation issue in the DOM: Networking component.
* CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
component.
* CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the
XPCOM component.
* CVE-2026-100820: Privilege escalation in the Address Bar component.
* CVE-2026-100821: Site isolation issue in the Panning and Zooming component.
* CVE-2026-100822: Spoofing issue in the Networking: HTTP component.
* CVE-2026-100824: Privilege escalation in the Places component.
* CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component.
* CVE-2026-100826: Denial-of-service in the Storage: StorageManager component.
* CVE-2026-100828: Mitigation bypass in the Bookmarks & History component.
* CVE-2026-100829: Mitigation bypass in the DOM: Security component.
* CVE-2026-100830: Mitigation bypass in the DOM: Navigation component.
* CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
component.
* CVE-2026-100832: Use-after-free in the Graphics: Canvas2D component.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-1791
* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1791
## Package List:
* SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
* MozillaFirefox-translations-other-153.4.0-160000.1.1
* MozillaFirefox-debuginfo-153.4.0-160000.1.1
* MozillaFirefox-debugsource-153.4.0-160000.1.1
* MozillaFirefox-translations-common-153.4.0-160000.1.1
* MozillaFirefox-153.4.0-160000.1.1
* SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
* MozillaFirefox-devel-153.4.0-160000.1.1
* SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le x86_64)
* MozillaFirefox-translations-other-153.4.0-160000.1.1
* MozillaFirefox-debuginfo-153.4.0-160000.1.1
* MozillaFirefox-debugsource-153.4.0-160000.1.1
* MozillaFirefox-translations-common-153.4.0-160000.1.1
* MozillaFirefox-153.4.0-160000.1.1
* SUSE Linux Enterprise Server 16.0 (noarch)
* MozillaFirefox-devel-153.4.0-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-100756.html
* https://www.suse.com/security/cve/CVE-2026-100757.html
* https://www.suse.com/security/cve/CVE-2026-100758.html
* https://www.suse.com/security/cve/CVE-2026-100759.html
* https://www.suse.com/security/cve/CVE-2026-100760.html
* https://www.suse.com/security/cve/CVE-2026-100762.html
* https://www.suse.com/security/cve/CVE-2026-100765.html
* https://www.suse.com/security/cve/CVE-2026-100766.html
* https://www.suse.com/security/cve/CVE-2026-100767.html
* https://www.suse.com/security/cve/CVE-2026-100769.html
* https://www.suse.com/security/cve/CVE-2026-100770.html
* https://www.suse.com/security/cve/CVE-2026-100771.html
* https://www.suse.com/security/cve/CVE-2026-100772.html
* https://www.suse.com/security/cve/CVE-2026-100773.html
* https://www.suse.com/security/cve/CVE-2026-100774.html
* https://www.suse.com/security/cve/CVE-2026-100775.html
* https://www.suse.com/security/cve/CVE-2026-100776.html
* https://www.suse.com/security/cve/CVE-2026-100777.html
* https://www.suse.com/security/cve/CVE-2026-100778.html
* https://www.suse.com/security/cve/CVE-2026-100779.html
* https://www.suse.com/security/cve/CVE-2026-100780.html
* https://www.suse.com/security/cve/CVE-2026-100781.html
* https://www.suse.com/security/cve/CVE-2026-100782.html
* https://www.suse.com/security/cve/CVE-2026-100783.html
* https://www.suse.com/security/cve/CVE-2026-100784.html
* https://www.suse.com/security/cve/CVE-2026-100785.html
* https://www.suse.com/security/cve/CVE-2026-100786.html
* https://www.suse.com/security/cve/CVE-2026-100787.html
* https://www.suse.com/security/cve/CVE-2026-100788.html
* https://www.suse.com/security/cve/CVE-2026-100789.html
* https://www.suse.com/security/cve/CVE-2026-100790.html
* https://www.suse.com/security/cve/CVE-2026-100791.html
* https://www.suse.com/security/cve/CVE-2026-100792.html
* https://www.suse.com/security/cve/CVE-2026-100794.html
* https://www.suse.com/security/cve/CVE-2026-100797.html
* https://www.suse.com/security/cve/CVE-2026-100798.html
* https://www.suse.com/security/cve/CVE-2026-100800.html
* https://www.suse.com/security/cve/CVE-2026-100801.html
* https://www.suse.com/security/cve/CVE-2026-100803.html
* https://www.suse.com/security/cve/CVE-2026-100806.html
* https://www.suse.com/security/cve/CVE-2026-100807.html
* https://www.suse.com/security/cve/CVE-2026-100808.html
* https://www.suse.com/security/cve/CVE-2026-100809.html
* https://www.suse.com/security/cve/CVE-2026-100811.html
* https://www.suse.com/security/cve/CVE-2026-100812.html
* https://www.suse.com/security/cve/CVE-2026-100814.html
* https://www.suse.com/security/cve/CVE-2026-100815.html
* https://www.suse.com/security/cve/CVE-2026-100816.html
* https://www.suse.com/security/cve/CVE-2026-100818.html
* https://www.suse.com/security/cve/CVE-2026-100819.html
* https://www.suse.com/security/cve/CVE-2026-100820.html
* https://www.suse.com/security/cve/CVE-2026-100821.html
* https://www.suse.com/security/cve/CVE-2026-100822.html
* https://www.suse.com/security/cve/CVE-2026-100824.html
* https://www.suse.com/security/cve/CVE-2026-100825.html
* https://www.suse.com/security/cve/CVE-2026-100826.html
* https://www.suse.com/security/cve/CVE-2026-100828.html
* https://www.suse.com/security/cve/CVE-2026-100829.html
* https://www.suse.com/security/cve/CVE-2026-100830.html
* https://www.suse.com/security/cve/CVE-2026-100831.html
* https://www.suse.com/security/cve/CVE-2026-100832.html
* https://www.suse.com/security/cve/CVE-2026-96869.html
* https://bugzilla.suse.com/show_bug.cgi?id=1282929
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261005/5c5e3dea/attachment.htm>
More information about the sle-security-updates
mailing list