RHSA-2026:5932: Important: firefox security update
Important: firefox security update
Other sources
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.Security Fix(es): firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721) firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717) firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688) firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695) firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689) firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698) firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716) firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684) firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705) firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715) firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710) firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697) firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713) firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690) firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711) firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686) firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708) firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691) firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699) firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696) firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693) firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718) firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702) firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719) firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694) firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692) firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720) firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700) firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707) firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704) firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:5932?
The severity of RHSA-2026:5932 is categorized as important.
How do I fix RHSA-2026:5932?
To fix RHSA-2026:5932, update the firefox package to version 140.9.0-1.el8_10.
What vulnerabilities are addressed in RHSA-2026:5932?
RHSA-2026:5932 addresses a use-after-free vulnerability in the JavaScript Engine component (CVE-2026-4701).
Which software versions are affected by RHSA-2026:5932?
RHSA-2026:5932 affects multiple versions of Red Hat Enterprise Linux, including x86_64, ARM 64, and Power architecture.
Is there a workaround for RHSA-2026:5932?
There is no specific workaround mentioned for RHSA-2026:5932 other than applying the security update.