Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (Mozilla Firefox)
En bref
- Source
- NVD
- EPSS
- EPSS 0.50 % · centile 43 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mozilla
- Statut NVD
- Modified
Rechercher sur…
Description
Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Faiblesses (CWE)
Références
- https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370
- https://www.mozilla.org/security/advisories/mfsa2026-30/
- https://www.mozilla.org/security/advisories/mfsa2026-32/
- https://www.mozilla.org/security/advisories/mfsa2026-33/
- https://www.mozilla.org/security/advisories/mfsa2026-34/
- https://access.redhat.com/security/cve/CVE-2026-6786
- https://bugzilla.redhat.com/show_bug.cgi?id=2460088
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6786.json
- https://access.redhat.com/errata/RHSA-2026:19704
- https://access.redhat.com/errata/RHSA-2026:17690
- https://access.redhat.com/errata/RHSA-2026:19463
- https://access.redhat.com/errata/RHSA-2026:10767
- https://access.redhat.com/errata/RHSA-2026:12285
- https://access.redhat.com/errata/RHSA-2026:19041
- https://access.redhat.com/errata/RHSA-2026:19131
- https://access.redhat.com/errata/RHSA-2026:10766
- https://access.redhat.com/errata/RHSA-2026:13537
- https://access.redhat.com/errata/RHSA-2026:19655
- https://access.redhat.com/errata/RHSA-2026:19465
- https://access.redhat.com/errata/RHSA-2026:19542
- https://access.redhat.com/errata/RHSA-2026:19466
- https://access.redhat.com/errata/RHSA-2026:17477
- https://access.redhat.com/errata/RHSA-2026:19467
- https://access.redhat.com/errata/RHSA-2026:17687
- https://access.redhat.com/errata/RHSA-2026:19468
- https://access.redhat.com/errata/RHSA-2026:17689
- https://access.redhat.com/errata/RHSA-2026:19461
- https://access.redhat.com/errata/RHSA-2026:19464
- https://access.redhat.com/errata/RHSA-2026:19469
- https://access.redhat.com/errata/RHSA-2026:17688
- https://access.redhat.com/errata/RHSA-2026:19462
- https://access.redhat.com/errata/RHSA-2026:10757
- https://access.redhat.com/errata/RHSA-2026:15892
- https://access.redhat.com/errata/RHSA-2026:19201
- https://access.redhat.com/errata/RHSA-2026:19348
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | redhat-SADP |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-24127
- GCVE · GCVE-0-2026-6786
Avis du CERT-FR
- CERTFR-2026-AVI-0480 — Multiples vulnérabilités dans les produits Mozilla · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*< 150.0cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*≥ 140.0 < 140.10.0cpe:2.3:a:mozilla:thunderbird:*:*:*:*:esr:*:*:*≥ 140.0 < 140.10.0
Produits affectés
| Produit | Versions |
|---|---|
| Mozilla · Firefox | unaffected 140.10 ≤ 140.* ; unaffected 150 ≤ * |
| Mozilla · Thunderbird | unaffected 140.10 ≤ 140.* ; unaffected 150 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |