{ "schema_version": "1.7.0", "id": "MGASA-2026-0522", "published": "2026-10-20T02:38:36Z", "modified": "2026-10-20T02:13:42Z", "summary": "Updated firefox, nss, firefox-l10n packages fix security vulnerabilities", "details": "Privilege escalation in the Application Update component.\n(CVE-2026-109704)\nSandbox escape, site isolation issue due to incorrect boundary\nconditions, use-after-free in the Networking component.\n(CVE-2026-109705)\nUse-after-free in the Storage: IndexedDB component. (CVE-2026-109706)\nSandbox escape due to use-after-free in the Networking component.\n(CVE-2026-109707)\nSandbox escape due to incorrect boundary conditions in the Networking\ncomponent. (CVE-2026-109708)\nInformation disclosure, privilege escalation in the Security: Process\nSandboxing component. (CVE-2026-109709)\nUse-after-free in the Graphics: Text component. (CVE-2026-109710)\nUse-after-free in the Graphics: Canvas2D component. (CVE-2026-109711)\nSandbox escape due to uninitialized memory in the Graphics component.\n(CVE-2026-109712)\nUse-after-free in the Crash Reporting component. (CVE-2026-109713)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-109715)\nIncorrect boundary conditions in the JavaScript Engine component.\n(CVE-2026-109716)\nUse-after-free in the DOM: Bindings (WebIDL) component.\n(CVE-2026-109717)\nUse-after-free in the XML component. (CVE-2026-109718)\nRace condition, use-after-free in the Graphics: CanvasWebGL component.\n(CVE-2026-109719)\nJIT miscompilation in the JavaScript: WebAssembly component.\n(CVE-2026-109720)\nIncorrect boundary conditions in the JavaScript Engine: JIT component.\n(CVE-2026-109721)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-109722)\nInteger overflow in the Layout: Text and Fonts component.\n(CVE-2026-109723)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-109724)\nUse-after-free in the DOM: Core & HTML component. (CVE-2026-109725)\nUse-after-free in the SVG component. (CVE-2026-109726)\nUse-after-free in the Audio/Video component. (CVE-2026-109727)\nUse-after-free in the DOM: Animation component. (CVE-2026-109728)\nUse-after-free in the JavaScript Engine: JIT component.\n(CVE-2026-109729)\nInteger overflow in the Graphics component. (CVE-2026-109730)\nIncorrect boundary conditions in the Graphics: Canvas2D component.\n(CVE-2026-109731)\nUse-after-free in the DOM: Streams component. (CVE-2026-109732)\nJIT miscompilation in the JavaScript Engine: JIT component.\n(CVE-2026-109733)\nMitigation bypass in the DOM: Security component. (CVE-2026-109734)\nFrame poisoning in the Layout component. (CVE-2026-109736)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109737)\nUse-after-free in the Audio/Video: Playback component. (CVE-2026-109738)\nUse-after-free in the Storage: Bucket File System component.\n(CVE-2026-109741)\nInformation disclosure in the PDF Viewer component. (CVE-2026-109742)\nPrivilege escalation in the Panning and Zooming component.\n(CVE-2026-109743)\nOther issue in the DOM: File component. (CVE-2026-109744)\nSandbox escape due to uninitialized memory in the DOM: Web Serial\ncomponent. (CVE-2026-109745)\nMitigation bypass in the File Handling component. (CVE-2026-109782)\nInformation disclosure in the Networking component. (CVE-2026-109751)\nUse-after-free in the DOM: Workers component. (CVE-2026-109752)\nIncorrect boundary conditions in the Layout component. (CVE-2026-109753)\nIncorrect boundary conditions in the DOM: Editor component.\n(CVE-2026-109754)\nPrivilege escalation in the DOM: Navigation component. (CVE-2026-109756)\nSandbox escape due to race condition in the Networking component.\n(CVE-2026-109757)\nSite isolation issue in the Networking component. (CVE-2026-109759)\nMitigation bypass in the Networking: HTTP component. (CVE-2026-109760)\nIncorrect boundary conditions in the SVG component. (CVE-2026-109762)\nMitigation bypass in the File Handling component. (CVE-2026-109763)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109764)\nRace condition, use-after-free in the Graphics: Text component.\n(CVE-2026-109765)\nMitigation bypass in the Enterprise Policies component.\n(CVE-2026-109766)\nInformation disclosure in the Networking component. (CVE-2026-109767)\nMitigation bypass in the File Handling component. (CVE-2026-109783)\nSpoofing issue in the DOM: Web Serial component. (CVE-2026-109770)\nDenial-of-service in the WebRTC component. (CVE-2026-109775)\nRace condition in the XPCOM component. (CVE-2026-109776)\nInformation disclosure in the Storage: IndexedDB component.\n(CVE-2026-109777)\nPrivilege escalation in the WebExtensions component. (CVE-2026-109778)\nDenial-of-service in the Printing: Output component. (CVE-2026-109781)\n", "upstream": [ "CVE-2026-109704", "CVE-2026-109705", "CVE-2026-109706", "CVE-2026-109707", "CVE-2026-109708", "CVE-2026-109709", "CVE-2026-109710", "CVE-2026-109711", "CVE-2026-109712", "CVE-2026-109713", "CVE-2026-109715", "CVE-2026-109716", "CVE-2026-109717", "CVE-2026-109718", "CVE-2026-109719", "CVE-2026-109720", "CVE-2026-109721", "CVE-2026-109722", "CVE-2026-109723", "CVE-2026-109724", "CVE-2026-109725", "CVE-2026-109726", "CVE-2026-109727", "CVE-2026-109728", "CVE-2026-109729", "CVE-2026-109730", "CVE-2026-109731", "CVE-2026-109732", "CVE-2026-109733", "CVE-2026-109734", "CVE-2026-109736", "CVE-2026-109737", "CVE-2026-109738", "CVE-2026-109741", "CVE-2026-109742", "CVE-2026-109743", "CVE-2026-109744", "CVE-2026-109745", "CVE-2026-109751", "CVE-2026-109752", "CVE-2026-109753", "CVE-2026-109754", "CVE-2026-109756", "CVE-2026-109757", "CVE-2026-109759", "CVE-2026-109760", "CVE-2026-109762", "CVE-2026-109763", "CVE-2026-109764", "CVE-2026-109765", "CVE-2026-109766", "CVE-2026-109767", "CVE-2026-109770", "CVE-2026-109775", "CVE-2026-109776", "CVE-2026-109777", "CVE-2026-109778", "CVE-2026-109781", "CVE-2026-109782", "CVE-2026-109783" ], "references": [ { "type": "ADVISORY", "url": "https://advisories.mageia.org/MGASA-2026-0522.html" }, { "type": "REPORT", "url": "https://bugs.mageia.org/show_bug.cgi?id=36500" }, { "type": "WEB", "url": "https://firefox-source-docs.mozilla.org/security/nss/releases/nss_3_131.html" }, { "type": "WEB", "url": "https://www.firefox.com/en-US/firefox/153.5.0/releasenotes/" }, { "type": "ADVISORY", "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2026-108/" } ], "affected": [ { "package": { "ecosystem": "Mageia:10", "name": "firefox", "purl": "pkg:rpm/mageia/firefox?arch=source&distro=mageia-10" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "153.5.0-1.mga10" } ] } ], "ecosystem_specific": { "section": "core" } }, { "package": { "ecosystem": "Mageia:10", "name": "nss", "purl": "pkg:rpm/mageia/nss?arch=source&distro=mageia-10" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "3.131.0-1.mga10" } ] } ], "ecosystem_specific": { "section": "core" } }, { "package": { "ecosystem": "Mageia:10", "name": "firefox-l10n", "purl": "pkg:rpm/mageia/firefox-l10n?arch=source&distro=mageia-10" }, "ranges": [ { "type": "ECOSYSTEM", "events": [ { "introduced": "0" }, { "fixed": "153.5.0-1.mga10" } ] } ], "ecosystem_specific": { "section": "core" } } ], "credits": [ { "name": "Mageia", "type": "COORDINATOR", "contact": [ "https://wiki.mageia.org/en/Packages_Security_Team" ] } ] }