This update for MozillaFirefox fixes the following issues
- Update to Firefox Extended Support Release 140.11.0 ESR MFSA 2026-48 (bsc#1265212).
MFSA 2026-48:
- CVE-2026-8388: Incorrect boundary conditions in the JavaScript Engine: JIT component.
- CVE-2026-8391: Other issue in the JavaScript Engine component.
- CVE-2026-8401: Sandbox escape in the Profile Backup component.
- CVE-2026-8946: Incorrect boundary conditions in the Audio/Video: Web Codecs component.
- CVE-2026-8947: Use-after-free in the DOM: Bindings (WebIDL) component.
- CVE-2026-8949: Integer overflow in the Widget: Win32 component.
- CVE-2026-8950: Same-origin policy bypass in the Networking: HTTP component.
- CVE-2026-8953: Sandbox escape due to use-after-free in the Disability Access APIs component.
- CVE-2026-8954: Incorrect boundary conditions, integer overflow in the Audio/Video component.
- CVE-2026-8955: Privilege escalation in the DOM: Workers component.
- CVE-2026-8956: Integer overflow in the Networking: JAR component.
- CVE-2026-8957: Privilege escalation in the Enterprise Policies component.
- CVE-2026-8958: Information disclosure, sandbox escape in the Security: Process Sandboxing component.
- CVE-2026-8959: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
- CVE-2026-8961: Spoofing issue in the Form Autofill component.
- CVE-2026-8962: Mitigation bypass in the DOM: Security component.
- CVE-2026-8968: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component.
- CVE-2026-8970: Privilege escalation in the Security component.
- CVE-2026-8974: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151.
- CVE-2026-8975: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151.
Multiple security vulnerabilities affecting the CUPS printing system have been addressed in updates culminating in version 2.4.19. These vulnerabilities include authorization bypass, path traversal, heap overflow, potential remote code execution, information disclosure, and denial of service issues. The update fixes several bugs and security flaws that could impact print job handling and system stability.
A security update for bubblewrap addresses CVE-2026-41163, which involves improper process attachment via ptrace. This vulnerability can allow arbitrary privileged operations and local root escalation. The issue is fixed in the update provided by the SUSE Product Security Team. No specific affected versions are stated. The severity is assessed as high due to the potential for privilege escalation.
The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.
Security Fix(es):
* wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405)
* wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.
Security Fix(es):
* firefox: Other issue in the WebRTC component (CVE-2026-8094)
* firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)
* firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Two vulnerabilities in the libexif library used by Red Hat Enterprise Linux 9.2 can lead to information disclosure, crashes, and denial of service. These issues stem from integer overflow and underflow errors in the handling and decoding of Nikon MakerNote metadata. The vulnerabilities have been rated with moderate severity by Red Hat Product Security. A security update addressing these issues is available for affected Red Hat Enterprise Linux 9.2 versions.
A security update for perl-HTTP-Tiny addresses a vulnerability identified as CVE-2026-7010, which involves invalid characters in HTTP headers and potential header smuggling. The update fixes these issues in version 0.093 and later. The vulnerability could allow manipulation of HTTP headers, but no active exploits are reported. The update also includes other improvements and fixes unrelated to the security issue.
This update for nginx fixes the following issues
- CVE-2026-27651: denial of service via undisclosed requests when the `ngx_mail_auth_http_module` is enabled
(bsc#1260415).
- CVE-2026-32647: NGINX worker memory over-read or over-write via a specially crafted MP4 file (bsc#1260420).
- CVE-2026-40701: heap use-after-free in the worker process when the `ssl_verify_client` and the `ssl_ocsp` directives
are set due to issue in the `ngx_http_ssl_module` module (bsc#1265229).
- CVE-2026-42934: heap buffer overread in the worker process due to issue in the `ngx_http_charset_module` module
(bsc#1265231).
- CVE-2026-42945: heap buffer overflow via crafted HTTP requests due to issue in `ngx_http_rewrite_module`
(bsc#1265232).
- CVE-2026-42946: excessive memory allocation and data overread due to issue in the `ngx_http_scgi_module` and
`ngx_http_uwsgi_module` modules (bsc#1265233).
This security update for libsndfile addresses three vulnerabilities: a buffer overflow in the ircam_read_header function when processing malformed IRCAM audio files (CVE-2025-52194), a memory leak in the mpeg_l3_encoder_init() function (CVE-2025-56226), and an integer overflow in IMA-ADPCM processing (CVE-2026-37555). These issues could lead to potential memory corruption or resource exhaustion. The update fixes these issues to improve the security and stability of libsndfile.
A vulnerability in the leancrypto library prior to version 1.7.1 involves an unsafe cast from size_t to uint8_t in the lc_x509_extract_name_segment() function. This issue has been addressed in version 1.7.1 with a security update that also includes multiple non-security fixes and improvements. The leancrypto library provides cryptographic algorithms focused on post-quantum cryptography resistance.
This security update for mozjs115 addresses three vulnerabilities: a NULL pointer dereference when processing empty external parameter entities, a denial of service caused by an infinite loop in DTD content parsing, and a NULL pointer dereference in 'setContext' after an out-of-memory condition. These issues could lead to application crashes or denial of service conditions. The update fixes these issues to improve stability and security.
This security update for git-bug addresses two vulnerabilities: CVE-2026-1229, involving an incorrect calculation in the secp384r1 CombinedMult function in the CIRCL library, and CVE-2026-41506, which causes HTTP authentication credentials to leak when following redirects during smart-HTTP clone and fetch operations. The update includes upgrading dependencies to fixed versions to resolve these issues.
This security update for perl-YAML-Syck addresses multiple bugs and vulnerabilities, including a critical heap buffer overflow (CVE-2026-4177) in the YAML emitter. The update fixes memory leaks, parsing errors, and crashes on Windows, improving stability and security. The fixes are included in versions 1.37 and later, with the critical heap buffer overflow resolved in version 1.37. No specific affected versions were explicitly stated in the input data.
Multiple vulnerabilities have been identified and fixed in the assimp library used by SUSE. These include issues such as a vulnerability in the GetNextLine function, a division by zero error, a heap-based buffer overflow, out-of-bounds reads, and potential application crashes caused by malformed files. These flaws could lead to application instability or crashes if exploited.
A security vulnerability (CVE-2025-2296) in the edk2 package used by Red Hat Enterprise Linux 10 allows arbitrary command execution due to improper input validation. The edk2 package provides UEFI firmware support for virtual machines such as QEMU and KVM. Red Hat has released an important security update addressing this issue for multiple architectures and variants of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products.
Red Hat has issued a moderate severity security advisory for the unbound DNS resolver packages addressing two vulnerabilities: CVE-2024-33655 (DNSBomb) and CVE-2025-11411 (domain hijacking via promiscuous records). These vulnerabilities affect Red Hat Enterprise Linux 10 versions prior to 10.2 and related CodeReady Linux Builder packages. The update to unbound version 1.24.2-7.el10 includes fixes for these issues and disables TLS 1.2 by default. Users of affected versions should apply the update to mitigate these vulnerabilities.