A critical use-after-free vulnerability exists in the JavaScript garbage collection (GC) component affecting multiple Mozilla products including Firefox and Thunderbird. This flaw allows for potential remote code execution or other severe impacts due to improper memory handling. The vulnerability affects Firefox versions prior to 148 and ESR versions prior to 115.33 and 140.8, as well as Thunderbird versions prior to 148 and 140.8. Mozilla has released fixes in Firefox 148 to address this issue.
A vulnerability in the Linux kernel netfilter nf_conncount subsystem caused the last_gc timestamp to update every time a new connection was tracked, even if garbage collection (GC) was not performed. This flaw could allow the connection list to grow indefinitely under high packet rates. The issue has been fixed by updating last_gc only when GC is actually performed. Multiple Linux kernel versions are affected, and a patch is available.
This update for MozillaThunderbird fixes the following issues:
Changes in MozillaThunderbird:
- Mozilla Thunderbird 140.8.1 ESR
* Add mail.openpgp.load_untested_gpgme_version to load untested
GPGME version
- Mozilla Thunderbird 140.8.0 ESR
MFSA 2026-17 (boo#1258568)
* CVE-2026-2757 (bmo#2001637)
Incorrect boundary conditions in the WebRTC: Audio/Video
component
* CVE-2026-2758 (bmo#2009608)
Use-after-free in the JavaScript: GC component
* CVE-2026-2759 (bmo#2010933)
Incorrect boundary conditions in the Graphics: ImageLib
component
* CVE-2026-2760 (bmo#2011062)
Sandbox escape due to incorrect boundary conditions in the
Graphics: WebRender component
* CVE-2026-2761 (bmo#2011063)
Sandbox escape in the Graphics: WebRender component
* CVE-2026-2762 (bmo#2011649)
Integer overflow in the JavaScript: Standard Library
component
* CVE-2026-2763 (bmo#2012018)
Use-after-free in the JavaScript Engine component
* CVE-2026-2764 (bmo#2012608)
JIT miscompilation, use-after-free in the JavaScript Engine:
JIT component
* CVE-2026-2765 (bmo#2013562)
Use-after-free in the JavaScript Engine component
* CVE-2026-2766 (bmo#2013583)
Use-after-free in the JavaScript Engine: JIT component
* CVE-2026-2767 (bmo#2013741)
Use-after-free in the JavaScript: WebAssembly component
* CVE-2026-2768 (bmo#2014101)
Sandbox escape in the Storage: IndexedDB component
* CVE-2026-2769 (bmo#2014550)
Use-after-free in the Storage: IndexedDB component
* CVE-2026-2770 (bmo#2014585)
Use-after-free in the DOM: Bindings (WebIDL) component
* CVE-2026-2771 (bmo#2014593)
Undefined behavior in the DOM: Core & HTML component
* CVE-2026-2772 (bmo#2014827)
Use-after-free in the Audio/Video: Playback component
* CVE-2026-2773 (bmo#2014832)
Incorrect boundary conditions in the Web Audio component
* CVE-2026-2774 (bmo#2014883)
Integer overflow in the Audio/Video component
* CVE-2026-2775 (bmo#2015199)
Mitigation bypass in the DOM: HTML Parser component
* CVE-2026-2776 (bmo#2015266)
Sandbox escape due to incorrect boundary conditions in the
Telemetry component in External Software
* CVE-2026-2777 (bmo#2015305)
Privilege escalation in the Messaging System component
* CVE-2026-2778 (bmo#2016358)
Sandbox escape due to incorrect boundary conditions in the
DOM: Core & HTML component
* CVE-2026-2779 (bmo#1164141)
Incorrect boundary conditions in the Networking: JAR
component
* CVE-2026-2780 (bmo#2007829)
Privilege escalation in the Netmonitor component
* CVE-2026-2781 (bmo#2009552)
Integer overflow in the Libraries component in NSS
* CVE-2026-2782 (bmo#2010743)
Privilege escalation in the Netmonitor component
* CVE-2026-2783 (bmo#2010943)
Information disclosure due to JIT miscompilation in the
JavaScript Engine: JIT component
* CVE-2026-2784 (bmo#2012984)
Mitigation bypass in the DOM: Security component
* CVE-2026-2785 (bmo#2013549)
Invalid pointer in the JavaScript Engine component
* CVE-2026-2786 (bmo#2013612)
Use-after-free in the JavaScript Engine component
* CVE-2026-2787 (bmo#2014560)
Use-after-free in the DOM: Window and Location component
* CVE-2026-2788 (bmo#2014824)
Incorrect boundary conditions in the Audio/Video: GMP
component
* CVE-2026-2789 (bmo#2015179)
Use-after-free in the Graphics: ImageLib component
* CVE-2026-2790 (bmo#2008426)
Same-origin policy bypass in the Networking: JAR component
* CVE-2026-2791 (bmo#2015220)
Mitigation bypass in the Networking: Cache component
* CVE-2026-2792 (bmo#2008912, bmo#2010050, bmo#2010275,
bmo#2012331)
Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird
ESR 140.8, Firefox 148 and Thunderbird 148
* CVE-2026-2793 (bmo#2015196, bmo#2016423, bmo#2016498)
Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR
140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
- Mozilla Thunderbird 140.7.2 ESR
MFSA 2026-11 (boo#1258231)
* CVE-2026-2447 (bmo#2014390)
Heap buffer overflow in libvpx
- Mozilla Thunderbird 140.7.1 ESR
MFSA 2026-08 (bsc#1257397)
* CVE-2026-0818 (bmo#1881530)
CSS-based exfiltration of the content from partially
encrypted emails when allowing remote content
- Support using system GnuPG with gpgme 2, boo#1253718
- Mozilla Thunderbird 140.7.0 ESR
MFSA 2026-05 (bsc#1256340)
* CVE-2026-0877 (bmo#1999257)
Mitigation bypass in the DOM: Security component
* CVE-2026-0878 (bmo#2003989)
Sandbox escape due to incorrect boundary conditions in the
Graphics: CanvasWebGL component
* CVE-2026-0879 (bmo#2004602)
Sandbox escape due to incorrect boundary conditions in the
Graphics component
* CVE-2026-0880 (bmo#2005014)
Sandbox escape due to integer overflow in the Graphics
component
* CVE-2026-0882 (bmo#1924125)
Use-after-free in the IPC component
* CVE-2025-14327
The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore Platform Agent for Windows versions prior to v49.20.1, v50.15.0, v51.12.0, v52.2.0 is affected by a local privilege escalation vulnerability. The service will attempt to read an OpenSSL configuration file from a non-existent location that standard Windows users have default write access to. This allows an unprivileged local user to create a crafted "openssl.cnf" file in that location and, by specifying the path to a custom DLL file in a custom OpenSSL engine definition, execute arbitrary commands with the privileges of the Guardicore Agent process. Since Guardicore Agent runs with SYSTEM privileges, this permits an unprivileged user to fully elevate privileges to SYSTEM level in this manner.
Improper Resource Shutdown or Release vulnerability in Apache Tomcat.
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.
The following versions were EOL at the time the CVE was created but are
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
The affected Raisecom devices allow SSH sessions to be established without completing user authentication. This could allow attackers to gain shell access without valid credentials.
Multiple security vulnerabilities affecting Mozilla Firefox and Thunderbird on Red Hat Enterprise Linux 7 Extended Lifecycle Support have been addressed in updates to Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143, and Thunderbird 143. These include sandbox escapes, same-origin policy bypass, memory safety bugs, information disclosure, integer overflow, and incorrect boundary conditions in various components such as Graphics Canvas2D, Layout, JavaScript GC, Networking Cache, and SVG. The update fixes these issues to improve security and stability.
A vulnerability in the Linux kernel's f2fs file system was fixed that could cause a system panic when using the 'mode=lfs' mount option. The issue occurs because foreground garbage collection (gc) was only triggered after block allocation, which could lead to out-of-space conditions and kernel BUGs during parallel writes. The fix allows foreground gc to trigger prior to block allocation in f2fs_map_blocks(). This vulnerability affects multiple Linux kernel versions and has a medium severity rating with a CVSS score of 5.5.
In the Linux kernel, the following vulnerability has been resolved: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places Fuzzing hit another invalid pointer dereference due to the lack of checking whether jffs2_prealloc_raw_node_refs() completed successfully. Subsequent logic implies that the node refs have been allocated. Handle that. The code is ready for propagating the error upwards. KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 1 PID: 5835 Comm: syz-executor145 Not tainted 5.10.234-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:jffs2_link_node_ref+0xac/0x690 fs/jffs2/nodelist.c:600 Call Trace: jffs2_mark_erased_block fs/jffs2/erase.c:460 [inline] jffs2_erase_pending_blocks+0x688/0x1860 fs/jffs2/erase.c:118 jffs2_garbage_collect_pass+0x638/0x1a00 fs/jffs2/gc.c:253 jffs2_reserve_space+0x3f4/0xad0 fs/jffs2/nodemgmt.c:167 jffs2_write_inode_range+0x246/0xb50 fs/jffs2/write.c:362 jffs2_write_end+0x712/0x1110 fs/jffs2/file.c:302 generic_perform_write+0x2c2/0x500 mm/filemap.c:3347 __generic_file_write_iter+0x252/0x610 mm/filemap.c:3465 generic_file_write_iter+0xdb/0x230 mm/filemap.c:3497 call_write_iter include/linux/fs.h:2039 [inline] do_iter_readv_writev+0x46d/0x750 fs/read_write.c:740 do_iter_write+0x18c/0x710 fs/read_write.c:866 vfs_writev+0x1db/0x6a0 fs/read_write.c:939 do_pwritev fs/read_write.c:1036 [inline] __do_sys_pwritev fs/read_write.c:1083 [inline] __se_sys_pwritev fs/read_write.c:1078 [inline] __x64_sys_pwritev+0x235/0x310 fs/read_write.c:1078 do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x67/0xd1 Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability in the Linux kernel's F2FS file system was fixed by adding a sanity check on the F2FS_INLINE_DATA flag in the inode during garbage collection (GC). The flaw could cause a kernel BUG due to improper handling of inline data inodes during background GC, potentially leading to system crashes. This issue affects certain Linux kernel versions and has been addressed in multiple patched releases.
CVE-2024-44934 is a use-after-free vulnerability in the Linux kernel's network bridge multicast code. It occurs because the kernel does not ensure that all previous garbage collection cycles have completed before removing a port, potentially leading to freeing a port while multicast group timers are still running. This flaw was detected by syzbot and affects certain Linux kernel versions prior to fixed releases. The vulnerability has a high severity score and can lead to memory corruption with potential impact on confidentiality, integrity, and availability.
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.