Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
  • Products

    Top Products

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Products

    Downloads and Containers

    • Downloads
    • Packages
    • Containers

    Top Resources

    • Documentation
    • Product Life Cycles
    • Product Compliance
    • Errata
  • Knowledge

    Red Hat Knowledge Center

    • Knowledgebase Solutions
    • Knowledgebase Articles
    • Customer Portal Labs
    • Errata

    Top Product Docs

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Product Docs

    Training and Certification

    • About
    • Course Index
    • Certification Index
    • Skill Assessment
  • Security

    Red Hat Product Security Center

    • Security Updates
    • Security Advisories
    • Red Hat CVE Database
    • Errata

    References

    • Security Bulletins
    • Severity Ratings
    • Security Data

    Top Resources

    • Security Labs
    • Backporting Policies
    • Security Blog
  • Support

    Red Hat Support

    • Support Cases
    • Troubleshoot
    • Get Support
    • Contact Red Hat Support

    Red Hat Community Support

    • Customer Portal Community
    • Community Discussions
    • Red Hat Accelerator Program

    Top Resources

    • Product Life Cycles
    • Customer Portal Labs
    • Red Hat JBoss Supported Configurations
    • Red Hat Lightspeed
Or troubleshoot an issue.

Select Your Language

  • English
  • Français
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Lightspeed
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift
  • Red Hat OpenShift AI
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat build of Keycloak
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Application Foundations
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
All Products
Red Hat Product Errata RHSA-2026:93957 - Security Advisory
Issued:
2026-11-02
Updated:
2026-11-02

RHSA-2026:93957 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Important: firefox security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for firefox is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

  • firefox: thunderbird: Privilege escalation in the DLL Services component (CVE-2026-100801)
  • firefox: thunderbird: Invalid pointer in the JavaScript Engine component (CVE-2026-117910)
  • firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-117876)
  • firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-117860)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics component (CVE-2026-117985)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117887)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117987)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117943)
  • firefox: thunderbird: Privilege escalation in the DOM: UI Events & Focus Handling component (CVE-2026-117995)
  • firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-117908)
  • firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-117934)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Playback component (CVE-2026-117905)
  • firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-117923)
  • firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-117890)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Tables component (CVE-2026-117879)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117895)
  • firefox: thunderbird: Use-after-free in the DOM: CSS Object Model component (CVE-2026-117941)
  • firefox: thunderbird: Mitigation bypass in the DOM: Push Subscriptions component (CVE-2026-117998)
  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-117880)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-117907)
  • firefox: thunderbird: Race condition in the IPC component (CVE-2026-117999)
  • firefox: thunderbird: Use-after-free in the DOM: Editor component (CVE-2026-117900)
  • firefox: thunderbird: Sandbox escape in the DOM: Networking component (CVE-2026-117868)
  • firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-117866)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117925)
  • firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-117882)
  • firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-117921)
  • firefox: thunderbird: Privilege escalation in the Toolkit component (CVE-2026-117981)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-117914)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Tables component (CVE-2026-117897)
  • firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Networking component (CVE-2026-117862)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117896)
  • firefox: Site isolation issue in the Networking: HTTP component (CVE-2026-117958)
  • firefox: thunderbird: Incorrect boundary conditions in the DOM: Core & HTML component (CVE-2026-117950)
  • firefox: thunderbird: Invalid pointer in the JavaScript Engine: JIT component (CVE-2026-117982)
  • firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-117865)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117986)
  • firefox: thunderbird: Integer overflow in the Graphics: Text component (CVE-2026-117993)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117980)
  • firefox: thunderbird: Use-after-free in the Audio/Video: Playback component (CVE-2026-117911)
  • firefox: thunderbird: Information disclosure in the Networking: HTTP component (CVE-2026-118000)
  • firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-117867)
  • firefox: thunderbird: Same-origin policy bypass in the CSS Parsing and Computation component (CVE-2026-117912)
  • firefox: thunderbird: Spoofing issue in the DOM: Core & HTML component (CVE-2026-117960)
  • firefox: thunderbird: Sandbox escape in the Form Manager component (CVE-2026-117864)
  • firefox: thunderbird: Invalid pointer in the Graphics: WebRender component (CVE-2026-117917)
  • firefox: thunderbird: Use-after-free in the DOM: Events component (CVE-2026-117931)
  • firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-117988)
  • firefox: thunderbird: Invalid pointer in the Graphics component (CVE-2026-117871)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-117898)
  • firefox: thunderbird: Use-after-free in the Panning and Zooming component (CVE-2026-117964)
  • firefox: thunderbird: Incorrect boundary conditions in the Security: PSM component (CVE-2026-117893)
  • firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component (CVE-2026-117892)
  • firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-117916)
  • firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-117902)
  • firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-117967)
  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-117947)
  • firefox: thunderbird: Invalid pointer in the Nimbus Desktop Client component (CVE-2026-117956)
  • firefox: thunderbird: Use-after-free in the Layout: Scrolling and Overflow component (CVE-2026-117875)
  • firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics: WebRender component (CVE-2026-117975)
  • firefox: thunderbird: Incorrect boundary conditions in the XML component (CVE-2026-117945)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117901)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-117946)
  • firefox: thunderbird: Incorrect boundary conditions in the SVG component (CVE-2026-117926)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117881)
  • firefox: thunderbird: Invalid pointer in the JavaScript Engine: JIT component (CVE-2026-117969)
  • firefox: thunderbird: Information disclosure in the CSS Parsing and Computation component (CVE-2026-117992)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117940)
  • firefox: thunderbird: Incorrect boundary conditions in the DOM: Service Workers component (CVE-2026-117963)
  • firefox: thunderbird: Site isolation issue in the DOM: Service Workers component (CVE-2026-117959)
  • firefox: thunderbird: Other issue, use-after-free in the Storage: IndexedDB component (CVE-2026-117878)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-117948)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117932)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-117886)
  • firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-117938)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-117927)
  • firefox: thunderbird: Use-after-free in the XSLT component (CVE-2026-117924)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117949)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Scrolling and Overflow component (CVE-2026-117984)
  • firefox: thunderbird: Use-after-free in the SVG component (CVE-2026-117913)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117936)
  • firefox: thunderbird: Invalid pointer in the JavaScript Engine component (CVE-2026-117937)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-117883)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117972)
  • firefox: thunderbird: Use-after-free in the Internationalization component (CVE-2026-117874)
  • firefox: thunderbird: Use-after-free in the Layout: Grid component (CVE-2026-117885)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-117978)
  • firefox: thunderbird: Use-after-free in the Layout component (CVE-2026-117944)
  • firefox: thunderbird: Information disclosure in the Networking: DNS component (CVE-2026-118003)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117953)
  • firefox: thunderbird: Information disclosure due to race condition in the Networking component (CVE-2026-118002)
  • firefox: thunderbird: Use-after-free in the DOM: HTML Parser component (CVE-2026-117920)
  • firefox: thunderbird: Use-after-free in the Audio/Video component (CVE-2026-117903)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-117942)
  • firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-117888)
  • firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Signaling component (CVE-2026-117894)
  • firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-117904)
  • firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-117955)
  • firefox: thunderbird: Use-after-free in the Networking: WebSockets component (CVE-2026-117922)
  • firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component (CVE-2026-117962)
  • firefox: thunderbird: Other issue in the Console component (CVE-2026-117977)
  • firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-117935)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117919)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117869)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-117891)
  • firefox: thunderbird: Use-after-free in the Networking component (CVE-2026-117884)
  • firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-117899)
  • firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-117861)
  • firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-117909)
  • firefox: thunderbird: Same-origin policy bypass in the CSS Parsing and Computation component (CVE-2026-117928)
  • firefox: thunderbird: Frame poisoning in the CSS Parsing and Computation component (CVE-2026-117933)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117989)
  • firefox: thunderbird: Use-after-free in the JavaScript: Standard Library component (CVE-2026-117872)
  • firefox: thunderbird: Incorrect boundary conditions in the JavaScript Engine component (CVE-2026-117889)
  • firefox: thunderbird: Incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-117979)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117968)
  • firefox: thunderbird: Use-after-free in the Graphics component (CVE-2026-117983)
  • firefox: thunderbird: Use-after-free in the Networking: DNS component (CVE-2026-117973)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117929)
  • firefox: thunderbird: Uninitialized memory in the Networking component (CVE-2026-117952)
  • firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-117873)
  • firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-117976)
  • firefox: thunderbird: Use-after-free in the DOM: Core & HTML component (CVE-2026-117951)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Block and Inline component (CVE-2026-117915)
  • firefox: thunderbird: Incorrect boundary conditions in the CSS Transitions and Animations component (CVE-2026-118004)
  • firefox: thunderbird: Use-after-free in the JavaScript: GC component (CVE-2026-117994)
  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-117939)
  • firefox: thunderbird: Information disclosure due to uninitialized memory in the Audio/Video component (CVE-2026-117863)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-117961)
  • firefox: thunderbird: Race condition in the Disability Access APIs component (CVE-2026-117970)
  • firefox: thunderbird: Use-after-free in the XML component (CVE-2026-117974)
  • firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-117966)
  • firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component (CVE-2026-117918)
  • firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-117991)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Widget component (CVE-2026-117997)
  • firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-117996)
  • firefox: thunderbird: Sandbox escape due to use-after-free in the Print Preview component (CVE-2026-117971)
  • firefox: thunderbird: Cryptographic issue in the WebRTC: Networking component (CVE-2026-117957)
  • firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-117870)
  • firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-117877)
  • firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-117990)
  • firefox: thunderbird: Same-origin policy bypass in the Address Bar component (CVE-2026-117965)
  • firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-117930)
  • firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-117906)
  • firefox: thunderbird: Use-after-free in the Layout: Positioned component (CVE-2026-117954)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

  • BZ - 2543116 - CVE-2026-100801 firefox: thunderbird: Privilege escalation in the DLL Services component
  • BZ - 2562012 - CVE-2026-117876 firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component
  • BZ - 2562013 - CVE-2026-117860 firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component
  • BZ - 2562014 - CVE-2026-117985 firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics component
  • BZ - 2562016 - CVE-2026-117887 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562017 - CVE-2026-117987 firefox: thunderbird: Use-after-free in the Graphics component
  • BZ - 2562027 - CVE-2026-117941 firefox: thunderbird: Use-after-free in the DOM: CSS Object Model component
  • BZ - 2562029 - CVE-2026-117880 firefox: thunderbird: Use-after-free in the XML component
  • BZ - 2562032 - CVE-2026-117900 firefox: thunderbird: Use-after-free in the DOM: Editor component
  • BZ - 2562035 - CVE-2026-117866 firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component
  • BZ - 2562037 - CVE-2026-117925 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562038 - CVE-2026-117882 firefox: thunderbird: Use-after-free in the Layout component
  • BZ - 2562058 - CVE-2026-117896 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562068 - CVE-2026-117865 firefox: thunderbird: Use-after-free in the JavaScript: GC component
  • BZ - 2562071 - CVE-2026-117986 firefox: thunderbird: Use-after-free in the Graphics component
  • BZ - 2562075 - CVE-2026-117980 firefox: thunderbird: Use-after-free in the Graphics component
  • BZ - 2562095 - CVE-2026-117931 firefox: thunderbird: Use-after-free in the DOM: Events component
  • BZ - 2562096 - CVE-2026-117988 firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
  • BZ - 2562098 - CVE-2026-117898 firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component
  • BZ - 2562100 - CVE-2026-117964 firefox: thunderbird: Use-after-free in the Panning and Zooming component
  • BZ - 2562103 - CVE-2026-117892 firefox: thunderbird: Privilege escalation due to use-after-free in the WebRTC: Networking component
  • BZ - 2562105 - CVE-2026-117916 firefox: thunderbird: Use-after-free in the XSLT component
  • BZ - 2562106 - CVE-2026-117902 firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component
  • BZ - 2562114 - CVE-2026-117875 firefox: thunderbird: Use-after-free in the Layout: Scrolling and Overflow component
  • BZ - 2562135 - CVE-2026-117881 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562148 - CVE-2026-117878 firefox: thunderbird: Other issue, use-after-free in the Storage: IndexedDB component
  • BZ - 2562157 - CVE-2026-117927 firefox: thunderbird: Use-after-free in the SVG component
  • BZ - 2562160 - CVE-2026-117949 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562162 - CVE-2026-117913 firefox: thunderbird: Use-after-free in the SVG component
  • BZ - 2562164 - CVE-2026-117936 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562168 - CVE-2026-117883 firefox: thunderbird: Use-after-free in the DOM: HTML Parser component
  • BZ - 2562172 - CVE-2026-117874 firefox: thunderbird: Use-after-free in the Internationalization component
  • BZ - 2562183 - CVE-2026-117920 firefox: thunderbird: Use-after-free in the DOM: HTML Parser component
  • BZ - 2562204 - CVE-2026-117935 firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component
  • BZ - 2562206 - CVE-2026-117919 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562209 - CVE-2026-117891 firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component
  • BZ - 2562221 - CVE-2026-117872 firefox: thunderbird: Use-after-free in the JavaScript: Standard Library component
  • BZ - 2562227 - CVE-2026-117973 firefox: thunderbird: Use-after-free in the Networking: DNS component
  • BZ - 2562234 - CVE-2026-117951 firefox: thunderbird: Use-after-free in the DOM: Core & HTML component
  • BZ - 2562243 - CVE-2026-117974 firefox: thunderbird: Use-after-free in the XML component
  • BZ - 2562250 - CVE-2026-117997 firefox: thunderbird: Sandbox escape due to use-after-free in the Widget component
  • BZ - 2562255 - CVE-2026-117971 firefox: thunderbird: Sandbox escape due to use-after-free in the Print Preview component
  • BZ - 2562269 - CVE-2026-117877 firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component
  • BZ - 2562276 - CVE-2026-117965 firefox: thunderbird: Same-origin policy bypass in the Address Bar component
  • BZ - 2562280 - CVE-2026-117930 firefox: thunderbird: Use-after-free in the DOM: Bindings (WebIDL) component
  • BZ - 2562281 - CVE-2026-117906 firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component
  • BZ - 2562284 - CVE-2026-117954 firefox: thunderbird: Use-after-free in the Layout: Positioned component

CVEs

  • CVE-2026-100801
  • CVE-2026-117860
  • CVE-2026-117861
  • CVE-2026-117862
  • CVE-2026-117863
  • CVE-2026-117864
  • CVE-2026-117865
  • CVE-2026-117866
  • CVE-2026-117867
  • CVE-2026-117868
  • CVE-2026-117869
  • CVE-2026-117870
  • CVE-2026-117871
  • CVE-2026-117872
  • CVE-2026-117873
  • CVE-2026-117874
  • CVE-2026-117875
  • CVE-2026-117876
  • CVE-2026-117877
  • CVE-2026-117878
  • CVE-2026-117879
  • CVE-2026-117880
  • CVE-2026-117881
  • CVE-2026-117882
  • CVE-2026-117883
  • CVE-2026-117884
  • CVE-2026-117885
  • CVE-2026-117886
  • CVE-2026-117887
  • CVE-2026-117888
  • CVE-2026-117889
  • CVE-2026-117890
  • CVE-2026-117891
  • CVE-2026-117892
  • CVE-2026-117893
  • CVE-2026-117894
  • CVE-2026-117895
  • CVE-2026-117896
  • CVE-2026-117897
  • CVE-2026-117898
  • CVE-2026-117899
  • CVE-2026-117900
  • CVE-2026-117901
  • CVE-2026-117902
  • CVE-2026-117903
  • CVE-2026-117904
  • CVE-2026-117905
  • CVE-2026-117906
  • CVE-2026-117907
  • CVE-2026-117908
  • CVE-2026-117909
  • CVE-2026-117910
  • CVE-2026-117911
  • CVE-2026-117912
  • CVE-2026-117913
  • CVE-2026-117914
  • CVE-2026-117915
  • CVE-2026-117916
  • CVE-2026-117917
  • CVE-2026-117918
  • CVE-2026-117919
  • CVE-2026-117920
  • CVE-2026-117921
  • CVE-2026-117922
  • CVE-2026-117923
  • CVE-2026-117924
  • CVE-2026-117925
  • CVE-2026-117926
  • CVE-2026-117927
  • CVE-2026-117928
  • CVE-2026-117929
  • CVE-2026-117930
  • CVE-2026-117931
  • CVE-2026-117932
  • CVE-2026-117933
  • CVE-2026-117934
  • CVE-2026-117935
  • CVE-2026-117936
  • CVE-2026-117937
  • CVE-2026-117938
  • CVE-2026-117939
  • CVE-2026-117940
  • CVE-2026-117941
  • CVE-2026-117942
  • CVE-2026-117943
  • CVE-2026-117944
  • CVE-2026-117945
  • CVE-2026-117946
  • CVE-2026-117947
  • CVE-2026-117948
  • CVE-2026-117949
  • CVE-2026-117950
  • CVE-2026-117951
  • CVE-2026-117952
  • CVE-2026-117953
  • CVE-2026-117954
  • CVE-2026-117955
  • CVE-2026-117956
  • CVE-2026-117957
  • CVE-2026-117958
  • CVE-2026-117959
  • CVE-2026-117960
  • CVE-2026-117961
  • CVE-2026-117962
  • CVE-2026-117963
  • CVE-2026-117964
  • CVE-2026-117965
  • CVE-2026-117966
  • CVE-2026-117967
  • CVE-2026-117968
  • CVE-2026-117969
  • CVE-2026-117970
  • CVE-2026-117971
  • CVE-2026-117972
  • CVE-2026-117973
  • CVE-2026-117974
  • CVE-2026-117975
  • CVE-2026-117976
  • CVE-2026-117977
  • CVE-2026-117978
  • CVE-2026-117979
  • CVE-2026-117980
  • CVE-2026-117981
  • CVE-2026-117982
  • CVE-2026-117983
  • CVE-2026-117984
  • CVE-2026-117985
  • CVE-2026-117986
  • CVE-2026-117987
  • CVE-2026-117988
  • CVE-2026-117989
  • CVE-2026-117990
  • CVE-2026-117991
  • CVE-2026-117992
  • CVE-2026-117993
  • CVE-2026-117994
  • CVE-2026-117995
  • CVE-2026-117996
  • CVE-2026-117997
  • CVE-2026-117998
  • CVE-2026-117999
  • CVE-2026-118000
  • CVE-2026-118002
  • CVE-2026-118003
  • CVE-2026-118004

References

  • https://access.redhat.com/security/updates/classification/#important
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux for x86_64 9

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
x86_64
firefox-153.6.0-1.el9_8.x86_64.rpm SHA-256: 5f62d4ee3eb09a7459998fbfd2077931b1dcc3234f7cd3889a14a0380e020bcc
firefox-debuginfo-153.6.0-1.el9_8.x86_64.rpm SHA-256: f0af825b9e7b99e48b71663f77c63e98ccffc0bdab85ce26693daf6593083720
firefox-debugsource-153.6.0-1.el9_8.x86_64.rpm SHA-256: 0683bc925caa2f09c0f0f782543add9302546159be176109e39c64dcff5a48bd
firefox-x11-153.6.0-1.el9_8.x86_64.rpm SHA-256: 1fbbd4acbc98be77fbbb6bc43a87115c1ba53b672f329f7ec495fbe2851ae43b

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
x86_64
firefox-153.6.0-1.el9_8.x86_64.rpm SHA-256: 5f62d4ee3eb09a7459998fbfd2077931b1dcc3234f7cd3889a14a0380e020bcc
firefox-debuginfo-153.6.0-1.el9_8.x86_64.rpm SHA-256: f0af825b9e7b99e48b71663f77c63e98ccffc0bdab85ce26693daf6593083720
firefox-debugsource-153.6.0-1.el9_8.x86_64.rpm SHA-256: 0683bc925caa2f09c0f0f782543add9302546159be176109e39c64dcff5a48bd
firefox-x11-153.6.0-1.el9_8.x86_64.rpm SHA-256: 1fbbd4acbc98be77fbbb6bc43a87115c1ba53b672f329f7ec495fbe2851ae43b

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
s390x
firefox-153.6.0-1.el9_8.s390x.rpm SHA-256: eddb8a48cdcecd2154dd8ba5db71693d14f6bbc7092ffcb16071ef94e3c087e4
firefox-debuginfo-153.6.0-1.el9_8.s390x.rpm SHA-256: ddcfd7399c953e7cf98ec7a483f86a60eaa86bf3312bb0b43950739bfe36c537
firefox-debugsource-153.6.0-1.el9_8.s390x.rpm SHA-256: 537a2991e756a6c840c21a38f13691979acbf2584e66857edcc91f96667a3309
firefox-x11-153.6.0-1.el9_8.s390x.rpm SHA-256: 5e3f60a94ca461ec6daf869e8f1414a7b7c408ab7c92c86173cb035f7cc80cf1

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
s390x
firefox-153.6.0-1.el9_8.s390x.rpm SHA-256: eddb8a48cdcecd2154dd8ba5db71693d14f6bbc7092ffcb16071ef94e3c087e4
firefox-debuginfo-153.6.0-1.el9_8.s390x.rpm SHA-256: ddcfd7399c953e7cf98ec7a483f86a60eaa86bf3312bb0b43950739bfe36c537
firefox-debugsource-153.6.0-1.el9_8.s390x.rpm SHA-256: 537a2991e756a6c840c21a38f13691979acbf2584e66857edcc91f96667a3309
firefox-x11-153.6.0-1.el9_8.s390x.rpm SHA-256: 5e3f60a94ca461ec6daf869e8f1414a7b7c408ab7c92c86173cb035f7cc80cf1

Red Hat Enterprise Linux for Power, little endian 9

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
ppc64le
firefox-153.6.0-1.el9_8.ppc64le.rpm SHA-256: c472aaa7562fdccb698fabc2740d0d2c88edfd8a2c3eb523e171f428ffdbd3f3
firefox-debuginfo-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 2cd08936d5f18c154648bab967a5784a56db73c9d910e21ca88df3b82b0fc4ad
firefox-debugsource-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 483b17607a15342b7ca2bd6975ff1fe2dad663c96d9d6f5c17a59c1e42ebe1e3
firefox-x11-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 915173d83ea67305269432c9639b2b010a5e54d66d0f0c9f7338e202a72a3ecf

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
ppc64le
firefox-153.6.0-1.el9_8.ppc64le.rpm SHA-256: c472aaa7562fdccb698fabc2740d0d2c88edfd8a2c3eb523e171f428ffdbd3f3
firefox-debuginfo-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 2cd08936d5f18c154648bab967a5784a56db73c9d910e21ca88df3b82b0fc4ad
firefox-debugsource-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 483b17607a15342b7ca2bd6975ff1fe2dad663c96d9d6f5c17a59c1e42ebe1e3
firefox-x11-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 915173d83ea67305269432c9639b2b010a5e54d66d0f0c9f7338e202a72a3ecf

Red Hat Enterprise Linux for ARM 64 9

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
aarch64
firefox-153.6.0-1.el9_8.aarch64.rpm SHA-256: 8e19aaecceed46fb9295ac6d4c93764a9678fb6e3f8310e2fc94e50125265517
firefox-debuginfo-153.6.0-1.el9_8.aarch64.rpm SHA-256: 53e93515d6759474636bdf77ac68ee55d7c9cd794bd76e6ce0e3e92c063dd1fb
firefox-debugsource-153.6.0-1.el9_8.aarch64.rpm SHA-256: bfe5458aa689d76f1a9e8d0e0e7926cef77d84d8cd2ca73cea473b4b928d27c6
firefox-x11-153.6.0-1.el9_8.aarch64.rpm SHA-256: 5480bfcfa2a3f3ad4bad3c0a10b3ef381378a2ee6d73419fd37b186c8b9ed4e6

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
aarch64
firefox-153.6.0-1.el9_8.aarch64.rpm SHA-256: 8e19aaecceed46fb9295ac6d4c93764a9678fb6e3f8310e2fc94e50125265517
firefox-debuginfo-153.6.0-1.el9_8.aarch64.rpm SHA-256: 53e93515d6759474636bdf77ac68ee55d7c9cd794bd76e6ce0e3e92c063dd1fb
firefox-debugsource-153.6.0-1.el9_8.aarch64.rpm SHA-256: bfe5458aa689d76f1a9e8d0e0e7926cef77d84d8cd2ca73cea473b4b928d27c6
firefox-x11-153.6.0-1.el9_8.aarch64.rpm SHA-256: 5480bfcfa2a3f3ad4bad3c0a10b3ef381378a2ee6d73419fd37b186c8b9ed4e6

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
ppc64le
firefox-153.6.0-1.el9_8.ppc64le.rpm SHA-256: c472aaa7562fdccb698fabc2740d0d2c88edfd8a2c3eb523e171f428ffdbd3f3
firefox-debuginfo-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 2cd08936d5f18c154648bab967a5784a56db73c9d910e21ca88df3b82b0fc4ad
firefox-debugsource-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 483b17607a15342b7ca2bd6975ff1fe2dad663c96d9d6f5c17a59c1e42ebe1e3
firefox-x11-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 915173d83ea67305269432c9639b2b010a5e54d66d0f0c9f7338e202a72a3ecf

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
x86_64
firefox-153.6.0-1.el9_8.x86_64.rpm SHA-256: 5f62d4ee3eb09a7459998fbfd2077931b1dcc3234f7cd3889a14a0380e020bcc
firefox-debuginfo-153.6.0-1.el9_8.x86_64.rpm SHA-256: f0af825b9e7b99e48b71663f77c63e98ccffc0bdab85ce26693daf6593083720
firefox-debugsource-153.6.0-1.el9_8.x86_64.rpm SHA-256: 0683bc925caa2f09c0f0f782543add9302546159be176109e39c64dcff5a48bd
firefox-x11-153.6.0-1.el9_8.x86_64.rpm SHA-256: 1fbbd4acbc98be77fbbb6bc43a87115c1ba53b672f329f7ec495fbe2851ae43b

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
aarch64
firefox-153.6.0-1.el9_8.aarch64.rpm SHA-256: 8e19aaecceed46fb9295ac6d4c93764a9678fb6e3f8310e2fc94e50125265517
firefox-debuginfo-153.6.0-1.el9_8.aarch64.rpm SHA-256: 53e93515d6759474636bdf77ac68ee55d7c9cd794bd76e6ce0e3e92c063dd1fb
firefox-debugsource-153.6.0-1.el9_8.aarch64.rpm SHA-256: bfe5458aa689d76f1a9e8d0e0e7926cef77d84d8cd2ca73cea473b4b928d27c6
firefox-x11-153.6.0-1.el9_8.aarch64.rpm SHA-256: 5480bfcfa2a3f3ad4bad3c0a10b3ef381378a2ee6d73419fd37b186c8b9ed4e6

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
s390x
firefox-153.6.0-1.el9_8.s390x.rpm SHA-256: eddb8a48cdcecd2154dd8ba5db71693d14f6bbc7092ffcb16071ef94e3c087e4
firefox-debuginfo-153.6.0-1.el9_8.s390x.rpm SHA-256: ddcfd7399c953e7cf98ec7a483f86a60eaa86bf3312bb0b43950739bfe36c537
firefox-debugsource-153.6.0-1.el9_8.s390x.rpm SHA-256: 537a2991e756a6c840c21a38f13691979acbf2584e66857edcc91f96667a3309
firefox-x11-153.6.0-1.el9_8.s390x.rpm SHA-256: 5e3f60a94ca461ec6daf869e8f1414a7b7c408ab7c92c86173cb035f7cc80cf1

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
x86_64
firefox-153.6.0-1.el9_8.x86_64.rpm SHA-256: 5f62d4ee3eb09a7459998fbfd2077931b1dcc3234f7cd3889a14a0380e020bcc
firefox-debuginfo-153.6.0-1.el9_8.x86_64.rpm SHA-256: f0af825b9e7b99e48b71663f77c63e98ccffc0bdab85ce26693daf6593083720
firefox-debugsource-153.6.0-1.el9_8.x86_64.rpm SHA-256: 0683bc925caa2f09c0f0f782543add9302546159be176109e39c64dcff5a48bd
firefox-x11-153.6.0-1.el9_8.x86_64.rpm SHA-256: 1fbbd4acbc98be77fbbb6bc43a87115c1ba53b672f329f7ec495fbe2851ae43b

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
aarch64
firefox-153.6.0-1.el9_8.aarch64.rpm SHA-256: 8e19aaecceed46fb9295ac6d4c93764a9678fb6e3f8310e2fc94e50125265517
firefox-debuginfo-153.6.0-1.el9_8.aarch64.rpm SHA-256: 53e93515d6759474636bdf77ac68ee55d7c9cd794bd76e6ce0e3e92c063dd1fb
firefox-debugsource-153.6.0-1.el9_8.aarch64.rpm SHA-256: bfe5458aa689d76f1a9e8d0e0e7926cef77d84d8cd2ca73cea473b4b928d27c6
firefox-x11-153.6.0-1.el9_8.aarch64.rpm SHA-256: 5480bfcfa2a3f3ad4bad3c0a10b3ef381378a2ee6d73419fd37b186c8b9ed4e6

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
ppc64le
firefox-153.6.0-1.el9_8.ppc64le.rpm SHA-256: c472aaa7562fdccb698fabc2740d0d2c88edfd8a2c3eb523e171f428ffdbd3f3
firefox-debuginfo-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 2cd08936d5f18c154648bab967a5784a56db73c9d910e21ca88df3b82b0fc4ad
firefox-debugsource-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 483b17607a15342b7ca2bd6975ff1fe2dad663c96d9d6f5c17a59c1e42ebe1e3
firefox-x11-153.6.0-1.el9_8.ppc64le.rpm SHA-256: 915173d83ea67305269432c9639b2b010a5e54d66d0f0c9f7338e202a72a3ecf

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
firefox-153.6.0-1.el9_8.src.rpm SHA-256: bbb1f2bef7b6150ac52675489092d0b62453a5792208324f2e5b23d6ed60e26b
s390x
firefox-153.6.0-1.el9_8.s390x.rpm SHA-256: eddb8a48cdcecd2154dd8ba5db71693d14f6bbc7092ffcb16071ef94e3c087e4
firefox-debuginfo-153.6.0-1.el9_8.s390x.rpm SHA-256: ddcfd7399c953e7cf98ec7a483f86a60eaa86bf3312bb0b43950739bfe36c537
firefox-debugsource-153.6.0-1.el9_8.s390x.rpm SHA-256: 537a2991e756a6c840c21a38f13691979acbf2584e66857edcc91f96667a3309
firefox-x11-153.6.0-1.el9_8.s390x.rpm SHA-256: 5e3f60a94ca461ec6daf869e8f1414a7b7c408ab7c92c86173cb035f7cc80cf1

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat LinkedIn YouTube Facebook X, formerly Twitter

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

Red Hat legal and privacy links

  • About Red Hat
  • Jobs
  • Events
  • Locations
  • Contact Red Hat
  • Red Hat Blog
  • Inclusion at Red Hat
  • Cool Stuff Store
  • Red Hat Summit
© 2026 Red Hat

Red Hat legal and privacy links

  • Privacy statement
  • Terms of use
  • All policies and guidelines
  • Digital accessibility