Advisories ยป MGASA-2026-0522

Updated firefox, nss, firefox-l10n packages fix security vulnerabilities

Publication date: 20 Oct 2026
Modification date: 20 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-109704 , CVE-2026-109705 , CVE-2026-109706 , CVE-2026-109707 , CVE-2026-109708 , CVE-2026-109709 , CVE-2026-109710 , CVE-2026-109711 , CVE-2026-109712 , CVE-2026-109713 , CVE-2026-109715 , CVE-2026-109716 , CVE-2026-109717 , CVE-2026-109718 , CVE-2026-109719 , CVE-2026-109720 , CVE-2026-109721 , CVE-2026-109722 , CVE-2026-109723 , CVE-2026-109724 , CVE-2026-109725 , CVE-2026-109726 , CVE-2026-109727 , CVE-2026-109728 , CVE-2026-109729 , CVE-2026-109730 , CVE-2026-109731 , CVE-2026-109732 , CVE-2026-109733 , CVE-2026-109734 , CVE-2026-109736 , CVE-2026-109737 , CVE-2026-109738 , CVE-2026-109741 , CVE-2026-109742 , CVE-2026-109743 , CVE-2026-109744 , CVE-2026-109745 , CVE-2026-109751 , CVE-2026-109752 , CVE-2026-109753 , CVE-2026-109754 , CVE-2026-109756 , CVE-2026-109757 , CVE-2026-109759 , CVE-2026-109760 , CVE-2026-109762 , CVE-2026-109763 , CVE-2026-109764 , CVE-2026-109765 , CVE-2026-109766 , CVE-2026-109767 , CVE-2026-109770 , CVE-2026-109775 , CVE-2026-109776 , CVE-2026-109777 , CVE-2026-109778 , CVE-2026-109781 , CVE-2026-109782 , CVE-2026-109783

Description

Privilege escalation in the Application Update component.
(CVE-2026-109704)
Sandbox escape, site isolation issue due to incorrect boundary
conditions, use-after-free in the Networking component.
(CVE-2026-109705)
Use-after-free in the Storage: IndexedDB component. (CVE-2026-109706)
Sandbox escape due to use-after-free in the Networking component.
(CVE-2026-109707)
Sandbox escape due to incorrect boundary conditions in the Networking
component. (CVE-2026-109708)
Information disclosure, privilege escalation in the Security: Process
Sandboxing component. (CVE-2026-109709)
Use-after-free in the Graphics: Text component. (CVE-2026-109710)
Use-after-free in the Graphics: Canvas2D component. (CVE-2026-109711)
Sandbox escape due to uninitialized memory in the Graphics component.
(CVE-2026-109712)
Use-after-free in the Crash Reporting component. (CVE-2026-109713)
Incorrect boundary conditions in the JavaScript Engine component.
(CVE-2026-109715)
Incorrect boundary conditions in the JavaScript Engine component.
(CVE-2026-109716)
Use-after-free in the DOM: Bindings (WebIDL) component.
(CVE-2026-109717)
Use-after-free in the XML component. (CVE-2026-109718)
Race condition, use-after-free in the Graphics: CanvasWebGL component.
(CVE-2026-109719)
JIT miscompilation in the JavaScript: WebAssembly component.
(CVE-2026-109720)
Incorrect boundary conditions in the JavaScript Engine: JIT component.
(CVE-2026-109721)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-109722)
Integer overflow in the Layout: Text and Fonts component.
(CVE-2026-109723)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-109724)
Use-after-free in the DOM: Core & HTML component. (CVE-2026-109725)
Use-after-free in the SVG component. (CVE-2026-109726)
Use-after-free in the Audio/Video component. (CVE-2026-109727)
Use-after-free in the DOM: Animation component. (CVE-2026-109728)
Use-after-free in the JavaScript Engine: JIT component.
(CVE-2026-109729)
Integer overflow in the Graphics component. (CVE-2026-109730)
Incorrect boundary conditions in the Graphics: Canvas2D component.
(CVE-2026-109731)
Use-after-free in the DOM: Streams component. (CVE-2026-109732)
JIT miscompilation in the JavaScript Engine: JIT component.
(CVE-2026-109733)
Mitigation bypass in the DOM: Security component. (CVE-2026-109734)
Frame poisoning in the Layout component. (CVE-2026-109736)
Mitigation bypass in the Enterprise Policies component.
(CVE-2026-109737)
Use-after-free in the Audio/Video: Playback component. (CVE-2026-109738)
Use-after-free in the Storage: Bucket File System component.
(CVE-2026-109741)
Information disclosure in the PDF Viewer component. (CVE-2026-109742)
Privilege escalation in the Panning and Zooming component.
(CVE-2026-109743)
Other issue in the DOM: File component. (CVE-2026-109744)
Sandbox escape due to uninitialized memory in the DOM: Web Serial
component. (CVE-2026-109745)
Mitigation bypass in the File Handling component. (CVE-2026-109782)
Information disclosure in the Networking component. (CVE-2026-109751)
Use-after-free in the DOM: Workers component. (CVE-2026-109752)
Incorrect boundary conditions in the Layout component. (CVE-2026-109753)
Incorrect boundary conditions in the DOM: Editor component.
(CVE-2026-109754)
Privilege escalation in the DOM: Navigation component. (CVE-2026-109756)
Sandbox escape due to race condition in the Networking component.
(CVE-2026-109757)
Site isolation issue in the Networking component. (CVE-2026-109759)
Mitigation bypass in the Networking: HTTP component. (CVE-2026-109760)
Incorrect boundary conditions in the SVG component. (CVE-2026-109762)
Mitigation bypass in the File Handling component. (CVE-2026-109763)
Mitigation bypass in the Enterprise Policies component.
(CVE-2026-109764)
Race condition, use-after-free in the Graphics: Text component.
(CVE-2026-109765)
Mitigation bypass in the Enterprise Policies component.
(CVE-2026-109766)
Information disclosure in the Networking component. (CVE-2026-109767)
Mitigation bypass in the File Handling component. (CVE-2026-109783)
Spoofing issue in the DOM: Web Serial component. (CVE-2026-109770)
Denial-of-service in the WebRTC component. (CVE-2026-109775)
Race condition in the XPCOM component. (CVE-2026-109776)
Information disclosure in the Storage: IndexedDB component.
(CVE-2026-109777)
Privilege escalation in the WebExtensions component. (CVE-2026-109778)
Denial-of-service in the Printing: Output component. (CVE-2026-109781)

References

SRPMS

10/core