{ "document":{ "aggregate_severity":{ "namespace":"https://nvd.nist.gov/vuln-metrics/cvss", "text":"Critical" }, "category":"csaf_vex", "csaf_version":"2.0", "distribution":{ "tlp":{ "label":"WHITE", "url":"https:/www.first.org/tlp/" } }, "lang":"en", "notes":[ { "text":"firefox security update", "category":"general", "title":"Synopsis" }, { "text":"An update for firefox is now available for openEuler-24.03-LTS-SP3", "category":"general", "title":"Summary" }, { "text":"Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability.\n\nSecurity Fix(es):\n\nSame-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117860)\n\nSandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117861)\n\nPrivilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117862)\n\nInformation disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117863)\n\nSandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117864)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117865)\n\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117866)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117867)\n\nSandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117868)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117869)\n\nUse-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117870)\n\nInvalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117871)\n\nUse-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117872)\n\nIncorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117873)\n\nUse-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117874)\n\nUse-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117875)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117876)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117877)\n\nOther issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117878)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117879)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117880)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117881)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117882)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117883)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117884)\n\nUse-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117885)\n\nIncorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117886)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117887)\n\nUninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117888)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117889)\n\nJIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117890)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117891)\n\nPrivilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117892)\n\nIncorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117893)\n\nIncorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117894)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117895)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117896)\n\nIncorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117897)\n\nUse-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117898)\n\nUse-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117899)\n\nUse-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117900)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117901)\n\nUse-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117902)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117903)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117904)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117905)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117906)\n\nUse-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117907)\n\nUse-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117908)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117909)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117910)\n\nUse-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117911)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117912)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117913)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117914)\n\nIncorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117915)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117916)\n\nInvalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117917)\n\nUse-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117918)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117919)\n\nUse-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117920)\n\nUse-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117921)\n\nUse-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117922)\n\nUse-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117923)\n\nUse-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117924)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117925)\n\nIncorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117926)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117927)\n\nSame-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117928)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117929)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117930)\n\nUse-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117931)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117932)\n\nFrame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117933)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117934)\n\nUse-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117935)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117936)\n\nInvalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117937)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117938)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117939)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117940)\n\nUse-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117941)\n\nIncorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117942)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117943)\n\nUse-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117944)\n\nIncorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117945)\n\nIncorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117946)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117947)\n\nUse-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117948)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117949)\n\nIncorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117950)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117951)\n\nUninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117952)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117953)\n\nUse-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117954)\n\nJIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117955)\n\nInvalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117956)\n\nCryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117957)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117958)\n\nSite isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117959)\n\nSpoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117960)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117961)\n\nSandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117962)\n\nIncorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117963)\n\nUse-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117964)\n\nSame-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117965)\n\nSite isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117966)\n\nMitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117967)\n\nUse-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117968)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117969)\n\nRace condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117970)\n\nSandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117971)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117972)\n\nUse-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117973)\n\nUse-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117974)\n\nSandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117975)\n\nSite isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117976)\n\nOther issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117977)\n\nIncorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117978)\n\nIncorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117979)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117980)\n\nPrivilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117981)\n\nInvalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117982)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117983)\n\nIncorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117984)\n\nSandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117985)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117986)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117987)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117988)\n\nUse-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117989)\n\nSandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117990)\n\nIncorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117991)\n\nInformation disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117992)\n\nInteger overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117993)\n\nUse-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117994)\n\nPrivilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117995)\n\nIncorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117996)\n\nSandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117997)\n\nMitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117998)\n\nRace condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-117999)\n\nInformation disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118000)\n\nInformation disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118002)\n\nInformation disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118003)\n\nIncorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.(CVE-2026-118004)", "category":"general", "title":"Description" }, { "text":"An update for firefox is now available for master/openEuler-20.03-LTS-SP4/openEuler-22.03-LTS-SP4/openEuler-24.03-LTS-Next/openEuler-24.03-LTS-SP1/openEuler-24.03-LTS-SP3/openEuler-24.03-LTS-SP4.\n\nopenEuler Security has rated this update as having a security impact of critical. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.", "category":"general", "title":"Topic" }, { "text":"Critical", "category":"general", "title":"Severity" }, { "text":"firefox", "category":"general", "title":"Affected Component" } ], "publisher":{ "issuing_authority":"openEuler security committee", "name":"openEuler", "namespace":"https://www.openeuler.org", "contact_details":"openeuler-security@openeuler.org", "category":"vendor" }, "references":[ { "summary":"openEuler-SA-2026-4675", "category":"self", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" }, { "summary":"CVE-2026-117860", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117860&packageName=firefox" }, { "summary":"CVE-2026-117861", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117861&packageName=firefox" }, { "summary":"CVE-2026-117862", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117862&packageName=firefox" }, { "summary":"CVE-2026-117863", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117863&packageName=firefox" }, { "summary":"CVE-2026-117864", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117864&packageName=firefox" }, { "summary":"CVE-2026-117865", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117865&packageName=firefox" }, { "summary":"CVE-2026-117866", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117866&packageName=firefox" }, { "summary":"CVE-2026-117867", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117867&packageName=firefox" }, { "summary":"CVE-2026-117868", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117868&packageName=firefox" }, { "summary":"CVE-2026-117869", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117869&packageName=firefox" }, { "summary":"CVE-2026-117870", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117870&packageName=firefox" }, { "summary":"CVE-2026-117871", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117871&packageName=firefox" }, { "summary":"CVE-2026-117872", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117872&packageName=firefox" }, { "summary":"CVE-2026-117873", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117873&packageName=firefox" }, { "summary":"CVE-2026-117874", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117874&packageName=firefox" }, { "summary":"CVE-2026-117875", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117875&packageName=firefox" }, { "summary":"CVE-2026-117876", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117876&packageName=firefox" }, { "summary":"CVE-2026-117877", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117877&packageName=firefox" }, { "summary":"CVE-2026-117878", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117878&packageName=firefox" }, { "summary":"CVE-2026-117879", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117879&packageName=firefox" }, { "summary":"CVE-2026-117880", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117880&packageName=firefox" }, { "summary":"CVE-2026-117881", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117881&packageName=firefox" }, { "summary":"CVE-2026-117882", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117882&packageName=firefox" }, { "summary":"CVE-2026-117883", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117883&packageName=firefox" }, { "summary":"CVE-2026-117884", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117884&packageName=firefox" }, { "summary":"CVE-2026-117885", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117885&packageName=firefox" }, { "summary":"CVE-2026-117886", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117886&packageName=firefox" }, { "summary":"CVE-2026-117887", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117887&packageName=firefox" }, { "summary":"CVE-2026-117888", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117888&packageName=firefox" }, { "summary":"CVE-2026-117889", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117889&packageName=firefox" }, { "summary":"CVE-2026-117890", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117890&packageName=firefox" }, { "summary":"CVE-2026-117891", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117891&packageName=firefox" }, { "summary":"CVE-2026-117892", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117892&packageName=firefox" }, { "summary":"CVE-2026-117893", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117893&packageName=firefox" }, { "summary":"CVE-2026-117894", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117894&packageName=firefox" }, { "summary":"CVE-2026-117895", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117895&packageName=firefox" }, { "summary":"CVE-2026-117896", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117896&packageName=firefox" }, { "summary":"CVE-2026-117897", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117897&packageName=firefox" }, { "summary":"CVE-2026-117898", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117898&packageName=firefox" }, { "summary":"CVE-2026-117899", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117899&packageName=firefox" }, { "summary":"CVE-2026-117900", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117900&packageName=firefox" }, { "summary":"CVE-2026-117901", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117901&packageName=firefox" }, { "summary":"CVE-2026-117902", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117902&packageName=firefox" }, { "summary":"CVE-2026-117903", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117903&packageName=firefox" }, { "summary":"CVE-2026-117904", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117904&packageName=firefox" }, { "summary":"CVE-2026-117905", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117905&packageName=firefox" }, { "summary":"CVE-2026-117906", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117906&packageName=firefox" }, { "summary":"CVE-2026-117907", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117907&packageName=firefox" }, { "summary":"CVE-2026-117908", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117908&packageName=firefox" }, { "summary":"CVE-2026-117909", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117909&packageName=firefox" }, { "summary":"CVE-2026-117910", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117910&packageName=firefox" }, { "summary":"CVE-2026-117911", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117911&packageName=firefox" }, { "summary":"CVE-2026-117912", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117912&packageName=firefox" }, { "summary":"CVE-2026-117913", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117913&packageName=firefox" }, { "summary":"CVE-2026-117914", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117914&packageName=firefox" }, { "summary":"CVE-2026-117915", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117915&packageName=firefox" }, { "summary":"CVE-2026-117916", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117916&packageName=firefox" }, { "summary":"CVE-2026-117917", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117917&packageName=firefox" }, { "summary":"CVE-2026-117918", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117918&packageName=firefox" }, { "summary":"CVE-2026-117919", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117919&packageName=firefox" }, { "summary":"CVE-2026-117920", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117920&packageName=firefox" }, { "summary":"CVE-2026-117921", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117921&packageName=firefox" }, { "summary":"CVE-2026-117922", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117922&packageName=firefox" }, { "summary":"CVE-2026-117923", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117923&packageName=firefox" }, { "summary":"CVE-2026-117924", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117924&packageName=firefox" }, { "summary":"CVE-2026-117925", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117925&packageName=firefox" }, { "summary":"CVE-2026-117926", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117926&packageName=firefox" }, { "summary":"CVE-2026-117927", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117927&packageName=firefox" }, { "summary":"CVE-2026-117928", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117928&packageName=firefox" }, { "summary":"CVE-2026-117929", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117929&packageName=firefox" }, { "summary":"CVE-2026-117930", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117930&packageName=firefox" }, { "summary":"CVE-2026-117931", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117931&packageName=firefox" }, { "summary":"CVE-2026-117932", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117932&packageName=firefox" }, { "summary":"CVE-2026-117933", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117933&packageName=firefox" }, { "summary":"CVE-2026-117934", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117934&packageName=firefox" }, { "summary":"CVE-2026-117935", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117935&packageName=firefox" }, { "summary":"CVE-2026-117936", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117936&packageName=firefox" }, { "summary":"CVE-2026-117937", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117937&packageName=firefox" }, { "summary":"CVE-2026-117938", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117938&packageName=firefox" }, { "summary":"CVE-2026-117939", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117939&packageName=firefox" }, { "summary":"CVE-2026-117940", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117940&packageName=firefox" }, { "summary":"CVE-2026-117941", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117941&packageName=firefox" }, { "summary":"CVE-2026-117942", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117942&packageName=firefox" }, { "summary":"CVE-2026-117943", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117943&packageName=firefox" }, { "summary":"CVE-2026-117944", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117944&packageName=firefox" }, { "summary":"CVE-2026-117945", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117945&packageName=firefox" }, { "summary":"CVE-2026-117946", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117946&packageName=firefox" }, { "summary":"CVE-2026-117947", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117947&packageName=firefox" }, { "summary":"CVE-2026-117948", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117948&packageName=firefox" }, { "summary":"CVE-2026-117949", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117949&packageName=firefox" }, { "summary":"CVE-2026-117950", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117950&packageName=firefox" }, { "summary":"CVE-2026-117951", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117951&packageName=firefox" }, { "summary":"CVE-2026-117952", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117952&packageName=firefox" }, { "summary":"CVE-2026-117953", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117953&packageName=firefox" }, { "summary":"CVE-2026-117954", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117954&packageName=firefox" }, { "summary":"CVE-2026-117955", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117955&packageName=firefox" }, { "summary":"CVE-2026-117956", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117956&packageName=firefox" }, { "summary":"CVE-2026-117957", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117957&packageName=firefox" }, { "summary":"CVE-2026-117958", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117958&packageName=firefox" }, { "summary":"CVE-2026-117959", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117959&packageName=firefox" }, { "summary":"CVE-2026-117960", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117960&packageName=firefox" }, { "summary":"CVE-2026-117961", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117961&packageName=firefox" }, { "summary":"CVE-2026-117962", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117962&packageName=firefox" }, { "summary":"CVE-2026-117963", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117963&packageName=firefox" }, { "summary":"CVE-2026-117964", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117964&packageName=firefox" }, { "summary":"CVE-2026-117965", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117965&packageName=firefox" }, { "summary":"CVE-2026-117966", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117966&packageName=firefox" }, { "summary":"CVE-2026-117967", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117967&packageName=firefox" }, { "summary":"CVE-2026-117968", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117968&packageName=firefox" }, { "summary":"CVE-2026-117969", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117969&packageName=firefox" }, { "summary":"CVE-2026-117970", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117970&packageName=firefox" }, { "summary":"CVE-2026-117971", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117971&packageName=firefox" }, { "summary":"CVE-2026-117972", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117972&packageName=firefox" }, { "summary":"CVE-2026-117973", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117973&packageName=firefox" }, { "summary":"CVE-2026-117974", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117974&packageName=firefox" }, { "summary":"CVE-2026-117975", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117975&packageName=firefox" }, { "summary":"CVE-2026-117976", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117976&packageName=firefox" }, { "summary":"CVE-2026-117977", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117977&packageName=firefox" }, { "summary":"CVE-2026-117978", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117978&packageName=firefox" }, { "summary":"CVE-2026-117979", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117979&packageName=firefox" }, { "summary":"CVE-2026-117980", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117980&packageName=firefox" }, { "summary":"CVE-2026-117981", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117981&packageName=firefox" }, { "summary":"CVE-2026-117982", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117982&packageName=firefox" }, { "summary":"CVE-2026-117983", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117983&packageName=firefox" }, { "summary":"CVE-2026-117984", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117984&packageName=firefox" }, { "summary":"CVE-2026-117985", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117985&packageName=firefox" }, { "summary":"CVE-2026-117986", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117986&packageName=firefox" }, { "summary":"CVE-2026-117987", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117987&packageName=firefox" }, { "summary":"CVE-2026-117988", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117988&packageName=firefox" }, { "summary":"CVE-2026-117989", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117989&packageName=firefox" }, { "summary":"CVE-2026-117990", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117990&packageName=firefox" }, { "summary":"CVE-2026-117991", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117991&packageName=firefox" }, { "summary":"CVE-2026-117992", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117992&packageName=firefox" }, { "summary":"CVE-2026-117993", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117993&packageName=firefox" }, { "summary":"CVE-2026-117994", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117994&packageName=firefox" }, { "summary":"CVE-2026-117995", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117995&packageName=firefox" }, { "summary":"CVE-2026-117996", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117996&packageName=firefox" }, { "summary":"CVE-2026-117997", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117997&packageName=firefox" }, { "summary":"CVE-2026-117998", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117998&packageName=firefox" }, { "summary":"CVE-2026-117999", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-117999&packageName=firefox" }, { "summary":"CVE-2026-118000", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-118000&packageName=firefox" }, { "summary":"CVE-2026-118002", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-118002&packageName=firefox" }, { "summary":"CVE-2026-118003", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-118003&packageName=firefox" }, { "summary":"CVE-2026-118004", "category":"self", "url":"https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-118004&packageName=firefox" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117860" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117861" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117862" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117863" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117864" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117865" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117866" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117867" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117868" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117869" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117870" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117871" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117872" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117873" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117874" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117875" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117876" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117877" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117878" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117879" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117880" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117881" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117882" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117883" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117884" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117885" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117886" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117887" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117888" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117889" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117890" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117891" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117892" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117893" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117894" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117895" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117896" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117897" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117898" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117899" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117900" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117901" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117902" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117903" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117904" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117905" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117906" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117907" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117908" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117909" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117910" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117911" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117912" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117913" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117914" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117915" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117916" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117917" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117918" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117919" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117920" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117921" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117922" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117923" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117924" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117925" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117926" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117927" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117928" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117929" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117930" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117931" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117932" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117933" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117934" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117935" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117936" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117937" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117938" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117939" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117940" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117941" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117942" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117943" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117944" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117945" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117946" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117947" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117948" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117949" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117950" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117951" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117952" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117953" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117954" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117955" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117956" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117957" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117958" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117959" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117960" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117961" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117962" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117963" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117964" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117965" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117966" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117967" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117968" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117969" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117970" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117971" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117972" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117973" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117974" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117975" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117976" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117977" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117978" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117979" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117980" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117981" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117982" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117983" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117984" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117985" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117986" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117987" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117988" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117989" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117990" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117991" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117992" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117993" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117994" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117995" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117996" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117997" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117998" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117999" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118000" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118002" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118003" }, { "summary":"nvd cve", "category":"external", "url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118004" }, { "summary":"openEuler-SA-2026-4675 vex file", "category":"self", "url":"https://repo.openeuler.org/security/data/csaf/advisories/2026/csaf-openeuler-sa-2026-4675.json" } ], "title":"An update for firefox is now available for openEuler-24.03-LTS-SP3", "tracking":{ "initial_release_date":"2026-11-09T09:27:04+08:00", "revision_history":[ { "date":"2026-11-09T09:27:04+08:00", "summary":"Initial", "number":"1.0.0" } ], "generator":{ "date":"2026-11-09T09:27:04+08:00", "engine":{ "name":"openEuler CSAF Tool V1.0" } }, "current_release_date":"2026-11-09T09:27:04+08:00", "id":"openEuler-SA-2026-4675", "version":"1.0.0", "status":"final" } }, "product_tree":{ "branches":[ { "name":"openEuler", "category":"vendor", "branches":[ { "name":"openEuler", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"openEuler-24.03-LTS-SP3", "name":"openEuler-24.03-LTS-SP3" }, "name":"openEuler-24.03-LTS-SP3", "category":"product_version" } ], "category":"product_name" }, { "name":"x86_64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-153.6.0-1.oe2403sp3.x86_64.rpm", "name":"firefox-153.6.0-1.oe2403sp3.x86_64.rpm" }, "name":"firefox-153.6.0-1.oe2403sp3.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64.rpm", "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64.rpm" }, "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-debugsource-153.6.0-1.oe2403sp3.x86_64.rpm", "name":"firefox-debugsource-153.6.0-1.oe2403sp3.x86_64.rpm" }, "name":"firefox-debugsource-153.6.0-1.oe2403sp3.x86_64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"aarch64", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-153.6.0-1.oe2403sp3.aarch64.rpm", "name":"firefox-153.6.0-1.oe2403sp3.aarch64.rpm" }, "name":"firefox-153.6.0-1.oe2403sp3.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64.rpm", "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64.rpm" }, "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64.rpm", "category":"product_version" }, { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-debugsource-153.6.0-1.oe2403sp3.aarch64.rpm", "name":"firefox-debugsource-153.6.0-1.oe2403sp3.aarch64.rpm" }, "name":"firefox-debugsource-153.6.0-1.oe2403sp3.aarch64.rpm", "category":"product_version" } ], "category":"architecture" }, { "name":"src", "branches":[ { "product":{ "product_identification_helper":{ "cpe":"cpe:/a:openEuler:openEuler:24.03-LTS-SP3" }, "product_id":"firefox-153.6.0-1.oe2403sp3.src.rpm", "name":"firefox-153.6.0-1.oe2403sp3.src.rpm" }, "name":"firefox-153.6.0-1.oe2403sp3.src.rpm", "category":"product_version" } ], "category":"architecture" } ] } ], "relationships":[ { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-153.6.0-1.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "name":"firefox-153.6.0-1.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-debugsource-153.6.0-1.oe2403sp3.x86_64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "name":"firefox-debugsource-153.6.0-1.oe2403sp3.x86_64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-153.6.0-1.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "name":"firefox-153.6.0-1.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "name":"firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-debugsource-153.6.0-1.oe2403sp3.aarch64.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "name":"firefox-debugsource-153.6.0-1.oe2403sp3.aarch64 as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" }, { "relates_to_product_reference":"openEuler-24.03-LTS-SP3", "product_reference":"firefox-153.6.0-1.oe2403sp3.src.rpm", "full_product_name":{ "product_id":"openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src", "name":"firefox-153.6.0-1.oe2403sp3.src as a component of openEuler-24.03-LTS-SP3" }, "category":"default_component_of" } ] }, "vulnerabilities":[ { "cve":"CVE-2026-117860", "notes":[ { "text":"Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117860" }, { "cve":"CVE-2026-117861", "notes":[ { "text":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117861" }, { "cve":"CVE-2026-117862", "notes":[ { "text":"Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117862" }, { "cve":"CVE-2026-117863", "notes":[ { "text":"Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-117863" }, { "cve":"CVE-2026-117864", "notes":[ { "text":"Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117864" }, { "cve":"CVE-2026-117865", "notes":[ { "text":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117865" }, { "cve":"CVE-2026-117866", "notes":[ { "text":"Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117866" }, { "cve":"CVE-2026-117867", "notes":[ { "text":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117867" }, { "cve":"CVE-2026-117868", "notes":[ { "text":"Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117868" }, { "cve":"CVE-2026-117869", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117869" }, { "cve":"CVE-2026-117870", "notes":[ { "text":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117870" }, { "cve":"CVE-2026-117871", "notes":[ { "text":"Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117871" }, { "cve":"CVE-2026-117872", "notes":[ { "text":"Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117872" }, { "cve":"CVE-2026-117873", "notes":[ { "text":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117873" }, { "cve":"CVE-2026-117874", "notes":[ { "text":"Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117874" }, { "cve":"CVE-2026-117875", "notes":[ { "text":"Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117875" }, { "cve":"CVE-2026-117876", "notes":[ { "text":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117876" }, { "cve":"CVE-2026-117877", "notes":[ { "text":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117877" }, { "cve":"CVE-2026-117878", "notes":[ { "text":"Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117878" }, { "cve":"CVE-2026-117879", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117879" }, { "cve":"CVE-2026-117880", "notes":[ { "text":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117880" }, { "cve":"CVE-2026-117881", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117881" }, { "cve":"CVE-2026-117882", "notes":[ { "text":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117882" }, { "cve":"CVE-2026-117883", "notes":[ { "text":"Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117883" }, { "cve":"CVE-2026-117884", "notes":[ { "text":"Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117884" }, { "cve":"CVE-2026-117885", "notes":[ { "text":"Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117885" }, { "cve":"CVE-2026-117886", "notes":[ { "text":"Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117886" }, { "cve":"CVE-2026-117887", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117887" }, { "cve":"CVE-2026-117888", "notes":[ { "text":"Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117888" }, { "cve":"CVE-2026-117889", "notes":[ { "text":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117889" }, { "cve":"CVE-2026-117890", "notes":[ { "text":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117890" }, { "cve":"CVE-2026-117891", "notes":[ { "text":"Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117891" }, { "cve":"CVE-2026-117892", "notes":[ { "text":"Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117892" }, { "cve":"CVE-2026-117893", "notes":[ { "text":"Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117893" }, { "cve":"CVE-2026-117894", "notes":[ { "text":"Incorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117894" }, { "cve":"CVE-2026-117895", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117895" }, { "cve":"CVE-2026-117896", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117896" }, { "cve":"CVE-2026-117897", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117897" }, { "cve":"CVE-2026-117898", "notes":[ { "text":"Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117898" }, { "cve":"CVE-2026-117899", "notes":[ { "text":"Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117899" }, { "cve":"CVE-2026-117900", "notes":[ { "text":"Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117900" }, { "cve":"CVE-2026-117901", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117901" }, { "cve":"CVE-2026-117902", "notes":[ { "text":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117902" }, { "cve":"CVE-2026-117903", "notes":[ { "text":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117903" }, { "cve":"CVE-2026-117904", "notes":[ { "text":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117904" }, { "cve":"CVE-2026-117905", "notes":[ { "text":"Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117905" }, { "cve":"CVE-2026-117906", "notes":[ { "text":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117906" }, { "cve":"CVE-2026-117907", "notes":[ { "text":"Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117907" }, { "cve":"CVE-2026-117908", "notes":[ { "text":"Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117908" }, { "cve":"CVE-2026-117909", "notes":[ { "text":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117909" }, { "cve":"CVE-2026-117910", "notes":[ { "text":"Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117910" }, { "cve":"CVE-2026-117911", "notes":[ { "text":"Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117911" }, { "cve":"CVE-2026-117912", "notes":[ { "text":"Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117912" }, { "cve":"CVE-2026-117913", "notes":[ { "text":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117913" }, { "cve":"CVE-2026-117914", "notes":[ { "text":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117914" }, { "cve":"CVE-2026-117915", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117915" }, { "cve":"CVE-2026-117916", "notes":[ { "text":"Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117916" }, { "cve":"CVE-2026-117917", "notes":[ { "text":"Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117917" }, { "cve":"CVE-2026-117918", "notes":[ { "text":"Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117918" }, { "cve":"CVE-2026-117919", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117919" }, { "cve":"CVE-2026-117920", "notes":[ { "text":"Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117920" }, { "cve":"CVE-2026-117921", "notes":[ { "text":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117921" }, { "cve":"CVE-2026-117922", "notes":[ { "text":"Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117922" }, { "cve":"CVE-2026-117923", "notes":[ { "text":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117923" }, { "cve":"CVE-2026-117924", "notes":[ { "text":"Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117924" }, { "cve":"CVE-2026-117925", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117925" }, { "cve":"CVE-2026-117926", "notes":[ { "text":"Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117926" }, { "cve":"CVE-2026-117927", "notes":[ { "text":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117927" }, { "cve":"CVE-2026-117928", "notes":[ { "text":"Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117928" }, { "cve":"CVE-2026-117929", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117929" }, { "cve":"CVE-2026-117930", "notes":[ { "text":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117930" }, { "cve":"CVE-2026-117931", "notes":[ { "text":"Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117931" }, { "cve":"CVE-2026-117932", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117932" }, { "cve":"CVE-2026-117933", "notes":[ { "text":"Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117933" }, { "cve":"CVE-2026-117934", "notes":[ { "text":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117934" }, { "cve":"CVE-2026-117935", "notes":[ { "text":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117935" }, { "cve":"CVE-2026-117936", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117936" }, { "cve":"CVE-2026-117937", "notes":[ { "text":"Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117937" }, { "cve":"CVE-2026-117938", "notes":[ { "text":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117938" }, { "cve":"CVE-2026-117939", "notes":[ { "text":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117939" }, { "cve":"CVE-2026-117940", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117940" }, { "cve":"CVE-2026-117941", "notes":[ { "text":"Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117941" }, { "cve":"CVE-2026-117942", "notes":[ { "text":"Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117942" }, { "cve":"CVE-2026-117943", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117943" }, { "cve":"CVE-2026-117944", "notes":[ { "text":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117944" }, { "cve":"CVE-2026-117945", "notes":[ { "text":"Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117945" }, { "cve":"CVE-2026-117946", "notes":[ { "text":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117946" }, { "cve":"CVE-2026-117947", "notes":[ { "text":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117947" }, { "cve":"CVE-2026-117948", "notes":[ { "text":"Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117948" }, { "cve":"CVE-2026-117949", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117949" }, { "cve":"CVE-2026-117950", "notes":[ { "text":"Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.3, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117950" }, { "cve":"CVE-2026-117951", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117951" }, { "cve":"CVE-2026-117952", "notes":[ { "text":"Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117952" }, { "cve":"CVE-2026-117953", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117953" }, { "cve":"CVE-2026-117954", "notes":[ { "text":"Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117954" }, { "cve":"CVE-2026-117955", "notes":[ { "text":"JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117955" }, { "cve":"CVE-2026-117956", "notes":[ { "text":"Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117956" }, { "cve":"CVE-2026-117957", "notes":[ { "text":"Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117957" }, { "cve":"CVE-2026-117958", "notes":[ { "text":"Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117958" }, { "cve":"CVE-2026-117959", "notes":[ { "text":"Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117959" }, { "cve":"CVE-2026-117960", "notes":[ { "text":"Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":4.7, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-117960" }, { "cve":"CVE-2026-117961", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117961" }, { "cve":"CVE-2026-117962", "notes":[ { "text":"Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117962" }, { "cve":"CVE-2026-117963", "notes":[ { "text":"Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117963" }, { "cve":"CVE-2026-117964", "notes":[ { "text":"Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117964" }, { "cve":"CVE-2026-117965", "notes":[ { "text":"Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117965" }, { "cve":"CVE-2026-117966", "notes":[ { "text":"Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117966" }, { "cve":"CVE-2026-117967", "notes":[ { "text":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117967" }, { "cve":"CVE-2026-117968", "notes":[ { "text":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117968" }, { "cve":"CVE-2026-117969", "notes":[ { "text":"Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117969" }, { "cve":"CVE-2026-117970", "notes":[ { "text":"Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117970" }, { "cve":"CVE-2026-117971", "notes":[ { "text":"Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117971" }, { "cve":"CVE-2026-117972", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117972" }, { "cve":"CVE-2026-117973", "notes":[ { "text":"Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117973" }, { "cve":"CVE-2026-117974", "notes":[ { "text":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117974" }, { "cve":"CVE-2026-117975", "notes":[ { "text":"Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117975" }, { "cve":"CVE-2026-117976", "notes":[ { "text":"Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117976" }, { "cve":"CVE-2026-117977", "notes":[ { "text":"Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117977" }, { "cve":"CVE-2026-117978", "notes":[ { "text":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117978" }, { "cve":"CVE-2026-117979", "notes":[ { "text":"Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117979" }, { "cve":"CVE-2026-117980", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117980" }, { "cve":"CVE-2026-117981", "notes":[ { "text":"Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117981" }, { "cve":"CVE-2026-117982", "notes":[ { "text":"Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":7.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117982" }, { "cve":"CVE-2026-117983", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117983" }, { "cve":"CVE-2026-117984", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117984" }, { "cve":"CVE-2026-117985", "notes":[ { "text":"Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117985" }, { "cve":"CVE-2026-117986", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117986" }, { "cve":"CVE-2026-117987", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117987" }, { "cve":"CVE-2026-117988", "notes":[ { "text":"Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117988" }, { "cve":"CVE-2026-117989", "notes":[ { "text":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117989" }, { "cve":"CVE-2026-117990", "notes":[ { "text":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117990" }, { "cve":"CVE-2026-117991", "notes":[ { "text":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117991" }, { "cve":"CVE-2026-117992", "notes":[ { "text":"Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-117992" }, { "cve":"CVE-2026-117993", "notes":[ { "text":"Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117993" }, { "cve":"CVE-2026-117994", "notes":[ { "text":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117994" }, { "cve":"CVE-2026-117995", "notes":[ { "text":"Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117995" }, { "cve":"CVE-2026-117996", "notes":[ { "text":"Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117996" }, { "cve":"CVE-2026-117997", "notes":[ { "text":"Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.6, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117997" }, { "cve":"CVE-2026-117998", "notes":[ { "text":"Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-117998" }, { "cve":"CVE-2026-117999", "notes":[ { "text":"Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"CRITICAL", "baseScore":9.8, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Critical", "category":"impact" } ], "title":"CVE-2026-117999" }, { "cve":"CVE-2026-118000", "notes":[ { "text":"Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-118000" }, { "cve":"CVE-2026-118002", "notes":[ { "text":"Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":5.3, "vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-118002" }, { "cve":"CVE-2026-118003", "notes":[ { "text":"Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"MEDIUM", "baseScore":6.5, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"Medium", "category":"impact" } ], "title":"CVE-2026-118003" }, { "cve":"CVE-2026-118004", "notes":[ { "text":"Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.", "category":"description", "title":"Vulnerability Description" } ], "product_status":{ "fixed":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] }, "remediations":[ { "product_ids":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ], "details":"firefox security update", "category":"vendor_fix", "url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4675" } ], "scores":[ { "cvss_v3":{ "baseSeverity":"HIGH", "baseScore":8.1, "vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version":"3.1" }, "products":[ "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.x86_64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debuginfo-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-debugsource-153.6.0-1.oe2403sp3.aarch64", "openEuler-24.03-LTS-SP3:firefox-153.6.0-1.oe2403sp3.src" ] } ], "threats":[ { "details":"High", "category":"impact" } ], "title":"CVE-2026-118004" } ] }