SUSE-SU-2026:3200-1: critical: Security update for MozillaFirefox
SLE-UPDATES
null at suse.de
Thu Jul 23 08:39:00 UTC 2026
# Security update for MozillaFirefox
Announcement ID: SUSE-SU-2026:3200-1
Release Date: 2026-07-22T18:48:43Z
Rating: critical
References:
* bsc#1271649
Cross-References:
* CVE-2026-15718
* CVE-2026-15719
* CVE-2026-16349
* CVE-2026-16350
* CVE-2026-16351
* CVE-2026-16352
* CVE-2026-16353
* CVE-2026-16354
* CVE-2026-16355
* CVE-2026-16356
* CVE-2026-16357
* CVE-2026-16358
* CVE-2026-16359
* CVE-2026-16360
* CVE-2026-16361
* CVE-2026-16362
* CVE-2026-16363
* CVE-2026-16368
* CVE-2026-16369
* CVE-2026-16371
* CVE-2026-16374
* CVE-2026-16375
* CVE-2026-16377
* CVE-2026-16379
* CVE-2026-16381
* CVE-2026-16383
* CVE-2026-16387
* CVE-2026-16390
* CVE-2026-16391
* CVE-2026-16396
* CVE-2026-16405
* CVE-2026-16412
CVSS scores:
* CVE-2026-15718 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
* CVE-2026-15719 ( NVD ): 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
* CVE-2026-16349 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16350 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16351 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16352 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16353 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16354 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-16355 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16356 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16357 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16358 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16359 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-16360 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16361 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16362 ( NVD ): 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
* CVE-2026-16363 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16368 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16369 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16371 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16374 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-16375 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16377 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16379 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16381 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-16383 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16387 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16390 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-16391 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-16396 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-16405 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVE-2026-16412 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products:
* SUSE Linux Enterprise High Performance Computing 12 SP5
* SUSE Linux Enterprise Server 12 SP5
* SUSE Linux Enterprise Server 12 SP5 LTSS
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
* SUSE Linux Enterprise Server for SAP Applications 12 SP5
An update that solves 32 vulnerabilities can now be installed.
## Description:
This update for MozillaFirefox fixes the following issues:
* Firefox Extended Support Release 140.13.0 ESR (MFSA 2026-70, bsc#1271649):
* CVE-2026-15718: Invalid pointer in the JavaScript: WebAssembly component.
* CVE-2026-15719: Site isolation issue in the DOM: Navigation component.
* CVE-2026-16349: Same-origin policy bypass in the DOM: Navigation component.
* CVE-2026-16350: Incorrect boundary conditions in the Audio/Video: cubeb
component.
* CVE-2026-16351: Sandbox escape due to use-after-free in the DOM: Navigation
component.
* CVE-2026-16352: Sandbox escape due to use-after-free in the Disability
Access APIs component.
* CVE-2026-16353: Invalid pointer in the DOM: Bindings (WebIDL) component.
* CVE-2026-16354: Information disclosure in the Graphics: ImageLib component.
* CVE-2026-16355: JIT miscompilation in the JavaScript Engine: JIT component.
* CVE-2026-16356: Sandbox escape due to use-after-free in the Disability
Access APIs component.
* CVE-2026-16357: Incorrect boundary conditions in the Graphics component.
* CVE-2026-16358: Site isolation issue in the Graphics: WebRender component.
* CVE-2026-16359: Incorrect boundary conditions in the Audio/Video: GMP
component.
* CVE-2026-16360: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR
140.13 and Firefox 153.
* CVE-2026-16361: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox
ESR 140.13.
* CVE-2026-16362: Use-after-free in the WebRTC: Audio/Video component.
* CVE-2026-16363: JIT miscompilation in the JavaScript: WebAssembly component.
* CVE-2026-16368: Incorrect boundary conditions in the JavaScript: WebAssembly
component.
* CVE-2026-16369: Integer overflow in the JavaScript: WebAssembly component.
* CVE-2026-16371: Privilege escalation in the DOM: Navigation component.
* CVE-2026-16374: Information disclosure in the Framework component in
DevTools.
* CVE-2026-16375: Site isolation issue in the Networking: HTTP component.
* CVE-2026-16377: Mitigation bypass in the PDF Viewer component.
* CVE-2026-16379: Privilege escalation in the DOM: Content Processes
component.
* CVE-2026-16381: Same-origin policy bypass in the Networking: DNS component.
* CVE-2026-16383: Mitigation bypass in the DOM: Networking component.
* CVE-2026-16387: Site isolation issue in the Networking component.
* CVE-2026-16390: Mitigation bypass in the Enterprise Policies component.
* CVE-2026-16391: Information disclosure in the Storage: IndexedDB component.
* CVE-2026-16396: Privilege escalation in WebExtensions.
* CVE-2026-16405: Information disclosure in the Networking: WebSockets
component.
* CVE-2026-16412: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox
153.
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server 12 SP5 LTSS
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-2026-3200=1
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security
zypper in -t patch SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-3200=1
## Package List:
* SUSE Linux Enterprise Server 12 SP5 LTSS (aarch64 ppc64le s390x x86_64)
* MozillaFirefox-translations-common-140.13.0-112.324.2
* MozillaFirefox-140.13.0-112.324.2
* MozillaFirefox-debuginfo-140.13.0-112.324.2
* MozillaFirefox-debugsource-140.13.0-112.324.2
* SUSE Linux Enterprise Server 12 SP5 LTSS (noarch)
* MozillaFirefox-devel-140.13.0-112.324.2
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (x86_64)
* MozillaFirefox-translations-common-140.13.0-112.324.2
* MozillaFirefox-140.13.0-112.324.2
* MozillaFirefox-debuginfo-140.13.0-112.324.2
* MozillaFirefox-debugsource-140.13.0-112.324.2
* SUSE Linux Enterprise Server 12 SP5 LTSS Extended Security (noarch)
* MozillaFirefox-devel-140.13.0-112.324.2
## References:
* https://www.suse.com/security/cve/CVE-2026-15718.html
* https://www.suse.com/security/cve/CVE-2026-15719.html
* https://www.suse.com/security/cve/CVE-2026-16349.html
* https://www.suse.com/security/cve/CVE-2026-16350.html
* https://www.suse.com/security/cve/CVE-2026-16351.html
* https://www.suse.com/security/cve/CVE-2026-16352.html
* https://www.suse.com/security/cve/CVE-2026-16353.html
* https://www.suse.com/security/cve/CVE-2026-16354.html
* https://www.suse.com/security/cve/CVE-2026-16355.html
* https://www.suse.com/security/cve/CVE-2026-16356.html
* https://www.suse.com/security/cve/CVE-2026-16357.html
* https://www.suse.com/security/cve/CVE-2026-16358.html
* https://www.suse.com/security/cve/CVE-2026-16359.html
* https://www.suse.com/security/cve/CVE-2026-16360.html
* https://www.suse.com/security/cve/CVE-2026-16361.html
* https://www.suse.com/security/cve/CVE-2026-16362.html
* https://www.suse.com/security/cve/CVE-2026-16363.html
* https://www.suse.com/security/cve/CVE-2026-16368.html
* https://www.suse.com/security/cve/CVE-2026-16369.html
* https://www.suse.com/security/cve/CVE-2026-16371.html
* https://www.suse.com/security/cve/CVE-2026-16374.html
* https://www.suse.com/security/cve/CVE-2026-16375.html
* https://www.suse.com/security/cve/CVE-2026-16377.html
* https://www.suse.com/security/cve/CVE-2026-16379.html
* https://www.suse.com/security/cve/CVE-2026-16381.html
* https://www.suse.com/security/cve/CVE-2026-16383.html
* https://www.suse.com/security/cve/CVE-2026-16387.html
* https://www.suse.com/security/cve/CVE-2026-16390.html
* https://www.suse.com/security/cve/CVE-2026-16391.html
* https://www.suse.com/security/cve/CVE-2026-16396.html
* https://www.suse.com/security/cve/CVE-2026-16405.html
* https://www.suse.com/security/cve/CVE-2026-16412.html
* https://bugzilla.suse.com/show_bug.cgi?id=1271649
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-updates/attachments/20260723/5ce9a3e6/attachment.htm>
More information about the sle-updates
mailing list