DEBIAN-CVE-2026-117946: Debian/firefox-esr vulnerability
Published Oct 27, 2026
·Updated
Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
Affected Software
6 affected componentsFixes available
debian/firefox-esr<153.6.0esr-1~deb12u2
153.6.0esr-1~deb12u2
debian/firefox-esr<153.6.0esr-1~deb13u1
153.6.0esr-1~deb13u1
debian/firefox-esr*
debian/thunderbird*
debian/thunderbird*
debian/thunderbird*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 153.6.0esr-1~deb12u2 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 153.6.0esr-1~deb13u1 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 115.44 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 153.6 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 159 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 153.6
Event History
Oct 27, 2026
CVE Published
via OSV·02:16 PM
Data Sourced
via OSV·02:16 PM
DescriptionAffected Software