[Git][security-tracker-team/security-tracker][master] Track fixes for firefox-esr via unstable
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Jul 22 06:36:35 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3ee3f21f by Salvatore Bonaccorso at 2026-07-22T07:36:06+02:00
Track fixes for firefox-esr via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -432,16 +432,16 @@ CVE-2026-15226 (A sandbox confinement bypass vulnerability exists in Canonical s
[trixie] - snapd <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/21/1
CVE-2026-16361 (Memory safety bugs present in Firefox ESR 115.37 and Firefox ESR 140.1 ...)
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16361
CVE-2026-16360 (Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 a ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16360
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16360
CVE-2026-16412 (Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16412
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16412
CVE-2026-16411 (Memory safety bugs present in Firefox 152. Some of these bugs showed e ...)
@@ -464,7 +464,7 @@ CVE-2026-16406 (Mitigation bypass in the Networking component. This vulnerabilit
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16406
CVE-2026-16405 (Information disclosure in the Networking: WebSockets component. This v ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16405
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16405
CVE-2026-16404 (Spoofing issue in Firefox for Android. This vulnerability was fixed in ...)
@@ -493,7 +493,7 @@ CVE-2026-16397 (Clickjacking issue in the WebExtensions component in Firefox for
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16397
CVE-2026-16396 (Privilege escalation in WebExtensions. This vulnerability was fixed in ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16396
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16396
CVE-2026-16395 (Integer overflow in the Audio/Video component. This vulnerability was ...)
@@ -504,7 +504,7 @@ CVE-2026-16394 (Mitigation bypass in the DOM: Security component. This vulnerabi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16394
CVE-2026-16359 (Incorrect boundary conditions in the Audio/Video: GMP component. This ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16359
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16359
CVE-2026-16393 (Incorrect boundary conditions in the Graphics: WebGPU component. This ...)
@@ -515,12 +515,12 @@ CVE-2026-16392 (JIT miscompilation in the JavaScript Engine: JIT component. This
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16392
CVE-2026-16391 (Information disclosure in the Storage: IndexedDB component. This vulne ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16391
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16391
CVE-2026-16390 (Mitigation bypass in the Enterprise Policies component. This vulnerabi ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16390
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16390
CVE-2026-16389 (Incorrect boundary conditions, integer overflow in the Libraries compo ...)
@@ -532,7 +532,7 @@ CVE-2026-16388 (Sandbox escape in the DOM: Networking component. This vulnerabil
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16388
CVE-2026-16387 (Site isolation issue in the Networking component. This vulnerability w ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16387
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16387
CVE-2026-16386 (Information disclosure due to uninitialized memory in the Graphics: We ...)
@@ -546,7 +546,7 @@ CVE-2026-16384 (Information disclosure due to uninitialized memory in the Graphi
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16384
CVE-2026-16383 (Mitigation bypass in the DOM: Networking component. This vulnerability ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16383
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16383
CVE-2026-16382 (Mitigation bypass in the DOM: Service Workers component. This vulnerab ...)
@@ -554,7 +554,7 @@ CVE-2026-16382 (Mitigation bypass in the DOM: Service Workers component. This vu
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16382
CVE-2026-16381 (Same-origin policy bypass in the Networking: DNS component. This vulne ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16381
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16381
CVE-2026-16380 (Mitigation bypass in the Networking component. This vulnerability was ...)
@@ -562,12 +562,12 @@ CVE-2026-16380 (Mitigation bypass in the Networking component. This vulnerabilit
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16380
CVE-2026-16358 (Site isolation issue in the Graphics: WebRender component. This vulner ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16358
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16358
CVE-2026-16379 (Privilege escalation in the DOM: Content Processes component. This vul ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16379
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16379
CVE-2026-16378 (Other issue in the DOM: Copy & Paste and Drag & Drop component. This v ...)
@@ -575,7 +575,7 @@ CVE-2026-16378 (Other issue in the DOM: Copy & Paste and Drag & Drop component.
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16378
CVE-2026-16377 (Mitigation bypass in the PDF Viewer component. This vulnerability was ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16377
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16377
CVE-2026-16376 (Denial-of-service in the Graphics: WebGPU component. This vulnerabilit ...)
@@ -583,12 +583,12 @@ CVE-2026-16376 (Denial-of-service in the Graphics: WebGPU component. This vulner
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16376
CVE-2026-16375 (Site isolation issue in the Networking: HTTP component. This vulnerabi ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16375
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16375
CVE-2026-16374 (Information disclosure in the Framework component in DevTools. This vu ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16374
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16374
CVE-2026-16373 (Information disclosure in the Privacy component in Firefox for Android ...)
@@ -599,7 +599,7 @@ CVE-2026-16372 (Privilege escalation in the DOM: Content Processes component. Th
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16372
CVE-2026-16371 (Privilege escalation in the DOM: Navigation component. This vulnerabil ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16371
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16371
CVE-2026-16370 (Mitigation bypass in the DOM: Networking component. This vulnerability ...)
@@ -607,27 +607,27 @@ CVE-2026-16370 (Mitigation bypass in the DOM: Networking component. This vulnera
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16370
CVE-2026-16357 (Incorrect boundary conditions in the Graphics component. This vulnerab ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16357
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16357
CVE-2026-16356 (Sandbox escape due to use-after-free in the Disability Access APIs com ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16356
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16356
CVE-2026-16355 (JIT miscompilation in the JavaScript Engine: JIT component. This vulne ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16355
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16355
CVE-2026-16369 (Integer overflow in the JavaScript: WebAssembly component. This vulner ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16369
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16369
CVE-2026-16368 (Incorrect boundary conditions in the JavaScript: WebAssembly component ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16368
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16368
CVE-2026-16367 (Sandbox escape due to invalid pointer in the Disability Access APIs co ...)
@@ -635,12 +635,12 @@ CVE-2026-16367 (Sandbox escape due to invalid pointer in the Disability Access A
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16354
CVE-2026-16354 (Information disclosure in the Graphics: ImageLib component. This vulne ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16354
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16354
CVE-2026-16353 (Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerab ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16353
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16353
CVE-2026-16366 (Privilege escalation in the DOM: Navigation component. This vulnerabil ...)
@@ -654,32 +654,32 @@ CVE-2026-16364 (Incorrect boundary conditions in the Audio/Video: Playback compo
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16364
CVE-2026-16363 (JIT miscompilation in the JavaScript: WebAssembly component. This vuln ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16363
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16363
CVE-2026-16352 (Sandbox escape due to use-after-free in the Disability Access APIs com ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16352
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16352
CVE-2026-16351 (Sandbox escape due to use-after-free in the DOM: Navigation component. ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16351
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16351
CVE-2026-16362 (Use-after-free in the WebRTC: Audio/Video component. This vulnerabilit ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16362
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16362
CVE-2026-16350 (Incorrect boundary conditions in the Audio/Video: cubeb component. Thi ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16350
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16350
CVE-2026-16349 (Same-origin policy bypass in the DOM: Navigation component. This vulne ...)
- firefox <unfixed>
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-68/#CVE-2026-16349
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-16349
CVE-2026-15370 (A flaw was found in libssh. During SFTP server directory listing, the ...)
@@ -7946,12 +7946,12 @@ CVE-2024-7708 (For requests that have a body, but reading the body may end up in
TODO: check
CVE-2026-15719 (We are aware that exploit code for this is public however we are not a ...)
- firefox 152.0.6-1
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/#CVE-2026-15719
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-15719
CVE-2026-15718 (We are aware that exploit code for this is public however we are not a ...)
- firefox 152.0.6-1
- - firefox-esr <unfixed>
+ - firefox-esr 140.13.0esr-1
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-67/#CVE-2026-15718
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-70/#CVE-2026-15718
CVE-2026-42491
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3ee3f21f502a6ad4e7f0cde2ef17b9705685c434
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3ee3f21f502a6ad4e7f0cde2ef17b9705685c434
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260722/cd8bd16f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list