firefox - Debian Package Tracker

general

source: firefox (main)
version: 158.0.1-1
maintainer: Maintainers of Mozilla-related packages (DMD)
uploaders: Mike Hommey [DMD]
arch: all any
std-ver: 3.9.8.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 158.0.1-1

versioned links

153.0.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
157.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
158.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
158.0.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

firefox (163 bugs: 2, 126, 35, 0)
firefox-l10n-ach
firefox-l10n-af
firefox-l10n-all
firefox-l10n-an
firefox-l10n-ar
firefox-l10n-ast
firefox-l10n-az
firefox-l10n-be
firefox-l10n-bg
firefox-l10n-bn
firefox-l10n-br
firefox-l10n-bs
firefox-l10n-ca
firefox-l10n-ca-valencia
firefox-l10n-cak
firefox-l10n-cs
firefox-l10n-cy
firefox-l10n-da
firefox-l10n-de
firefox-l10n-dsb
firefox-l10n-el
firefox-l10n-en-ca
firefox-l10n-en-gb
firefox-l10n-eo
firefox-l10n-es-ar
firefox-l10n-es-cl
firefox-l10n-es-es
firefox-l10n-es-mx
firefox-l10n-et
firefox-l10n-eu
firefox-l10n-fa
firefox-l10n-ff
firefox-l10n-fi (1 bugs: 0, 0, 1, 0)
firefox-l10n-fr (1 bugs: 0, 1, 0, 0)
firefox-l10n-fur
firefox-l10n-fy-nl
firefox-l10n-ga-ie
firefox-l10n-gd
firefox-l10n-gl (1 bugs: 0, 0, 1, 0)
firefox-l10n-gn
firefox-l10n-gu-in
firefox-l10n-he
firefox-l10n-hi-in
firefox-l10n-hr
firefox-l10n-hsb
firefox-l10n-hu
firefox-l10n-hy-am
firefox-l10n-ia
firefox-l10n-id
firefox-l10n-is
firefox-l10n-it
firefox-l10n-ja
firefox-l10n-ka
firefox-l10n-kab
firefox-l10n-kk
firefox-l10n-km
firefox-l10n-kn
firefox-l10n-ko
firefox-l10n-lij
firefox-l10n-lt
firefox-l10n-lv
firefox-l10n-mk
firefox-l10n-mr
firefox-l10n-ms
firefox-l10n-my
firefox-l10n-nb-no
firefox-l10n-ne-np
firefox-l10n-nl
firefox-l10n-nn-no
firefox-l10n-oc
firefox-l10n-pa-in (1 bugs: 0, 0, 1, 0)
firefox-l10n-pl
firefox-l10n-pt-br
firefox-l10n-pt-pt
firefox-l10n-rm
firefox-l10n-ro
firefox-l10n-ru
firefox-l10n-sat
firefox-l10n-sc
firefox-l10n-sco
firefox-l10n-si
firefox-l10n-sk
firefox-l10n-skr
firefox-l10n-sl
firefox-l10n-son
firefox-l10n-sq
firefox-l10n-sr
firefox-l10n-sv-se (1 bugs: 0, 0, 1, 0)
firefox-l10n-szl
firefox-l10n-ta
firefox-l10n-te
firefox-l10n-tg
firefox-l10n-th
firefox-l10n-tl
firefox-l10n-tr
firefox-l10n-trs
firefox-l10n-uk
firefox-l10n-ur
firefox-l10n-uz
firefox-l10n-vi
firefox-l10n-xh
firefox-l10n-zh-cn
firefox-l10n-zh-tw

action needed

166 security issues in sid high

There are 166 open security issues in sid.

166 important issues:

CVE-2026-100801: Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17.
CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117861: Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117863: Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117864: Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117865: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117866: Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117867: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117868: Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117869: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117870: Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117871: Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117872: Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117873: Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117874: Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117875: Use-after-free in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117876: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117877: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117878: Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117879: Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117880: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117881: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117882: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117883: Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117884: Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117885: Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117886: Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117887: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117888: Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117889: Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117890: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117891: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117892: Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117893: Incorrect boundary conditions in the Security: PSM component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117894: Incorrect boundary conditions in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117895: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117896: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117897: Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117898: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117899: Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117900: Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117901: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117902: Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117903: Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117904: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117905: Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117906: Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117907: Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117908: Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117909: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117910: Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117911: Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117912: Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117913: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117914: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117915: Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117916: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117917: Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117918: Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117919: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117920: Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117921: Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117922: Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117923: Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117924: Use-after-free in the XSLT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117925: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117926: Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117927: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117928: Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117929: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117930: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117931: Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117932: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117933: Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117934: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117935: Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117936: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117937: Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117938: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117939: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117940: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117941: Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117942: Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117943: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117944: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117945: Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117946: Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117947: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117948: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117949: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117950: Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117951: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117952: Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117953: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117954: Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117955: JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117956: Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117957: Cryptographic issue in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117958: Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117959: Site isolation issue in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117960: Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117961: Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117962: Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117963: Incorrect boundary conditions in the DOM: Service Workers component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117964: Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117965: Same-origin policy bypass in the Address Bar component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117966: Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117967: Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117968: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117969: Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117970: Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117971: Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117972: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117973: Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117974: Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117975: Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117976: Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117977: Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117978: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117979: Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117980: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117981: Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117982: Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117983: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117984: Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117985: Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117986: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117987: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117988: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117989: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117990: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117991: Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117992: Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117993: Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117994: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117995: Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117996: Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117997: Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117998: Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117999: Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118000: Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118002: Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118003: Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118004: Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118005: Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118006: Privilege escalation due to use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118007: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118008: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118009: Integer overflow, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118010: Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118011: Frame poisoning in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118012: Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118013: Use-after-free in the Layout: Images, Video, and HTML Frames component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118014: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118015: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118016: Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118017: Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118019: Race condition, use-after-free in the DOM: File component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118020: Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118021: Sandbox escape due to use-after-free in the XPCOM component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118022: Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118023: Sandbox escape due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118024: Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118025: Other issue in the SVG component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.
CVE-2026-118026: Invalid pointer in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Thunderbird 159.

Created: 2026-10-28 Last update: 2026-10-28 06:30

lintian reports 3 errors and 34 warnings high

Lintian reports 3 errors and 34 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-15 Last update: 2026-10-21 16:01

Standards version of the package is outdated. high

The package is severely out of date with respect to the Debian Policy. The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 3.9.8.0).

Created: 2017-08-09 Last update: 2026-10-21 10:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-10-26 Last update: 2026-10-28 10:49

16 bugs tagged patch in the BTS normal

The BTS contains patches fixing 16 bugs, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-28 10:48

Depends on packages which need a new maintainer normal

The packages that firefox depends on which need a new maintainer are:

hunspell-kk (#879871)
- Recommends: hunspell-kk
ifrench-gut (#1006643)
- Recommends: myspell-fr-gut
uzbek-wordlist (#841696)
- Recommends: hunspell-uz

Created: 2026-09-05 Last update: 2026-10-28 09:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 159.0-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

https://salsa.debian.org/api/v4/projects/mozilla-team%2Ffirefox API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-10-21 Last update: 2026-10-28 07:33

AppStream hints: 1 warning for firefox normal

AppStream found metadata issues for packages:

firefox: 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2019-01-27 Last update: 2025-04-02 15:31

debian/patches: 18 patches to forward upstream low

Among the 18 debian patches available in version 158.0.1-1 of the package, we noticed the following issues:

18 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-10-21 17:32

testing migrations

excuses:
- Migration status for firefox (- to 158.0.1-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating firefox would introduce bugs in testing: #1017919, #1099130, #817954, #992263, #993659
- ∙ ∙ Missing build on armhf
- ∙ ∙ Missing build on ppc64el
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Missing build on s390x
- ∙ ∙ Autopkgtest deferred on armhf: missing arch:armhf build
- ∙ ∙ Autopkgtest deferred on ppc64el: missing arch:ppc64el build
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest deferred on s390x: missing arch:s390x build
- ∙ ∙ Lintian check waiting for test results on s390x, ppc64el, riscv64, armhf - info
- ∙ ∙ Reproducibility check deferred on armhf: missing builds - info
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/f/firefox.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 7 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-10-21] Accepted firefox 158.0.1-1 (source) into unstable (Mike Hommey)
[2026-10-15] Accepted firefox 158.0-1 (source) into unstable (Mike Hommey)
[2026-10-09] Accepted firefox 157.0.1-1 (source) into unstable (Mike Hommey)
[2026-09-29] Accepted firefox 157.0-1 (source) into unstable (Mike Hommey)
[2026-09-16] Accepted firefox 156.0-1 (source) into unstable (Mike Hommey)
[2026-09-05] Accepted firefox 155.0.1-1 (source) into unstable (Mike Hommey)
[2026-09-02] Accepted firefox 155.0-1 (source) into unstable (Mike Hommey)
[2026-08-25] Accepted firefox 154.0.1-1 (source) into unstable (Mike Hommey)
[2026-08-19] Accepted firefox 154.0-1 (source) into unstable (Mike Hommey)
[2026-08-12] Accepted firefox 153.0.4-1 (source) into unstable (Mike Hommey)
[2026-08-04] Accepted firefox 153.0.3-1 (source) into unstable (Mike Hommey)
[2026-07-29] Accepted firefox 153.0.1-1 (source) into unstable (Mike Hommey)
[2026-07-28] Accepted firefox 153.0-1 (source) into unstable (Mike Hommey)
[2026-07-14] Accepted firefox 152.0.6-1 (source) into unstable (Mike Hommey)
[2026-07-12] Accepted firefox 152.0.5-3 (source) into unstable (Mike Hommey)
[2026-07-11] Accepted firefox 152.0.5-2 (source) into unstable (Mike Hommey)
[2026-07-07] Accepted firefox 152.0.5-1 (source) into unstable (Mike Hommey)
[2026-07-01] Accepted firefox 152.0.4-1 (source) into unstable (Mike Hommey)
[2026-06-26] Accepted firefox 152.0.3-1 (source) into unstable (Mike Hommey)
[2026-06-24] Accepted firefox 152.0.2-1 (source) into unstable (Mike Hommey)
[2026-06-19] Accepted firefox 152.0.1-1 (source) into unstable (Mike Hommey)
[2026-06-17] Accepted firefox 152.0-1 (source) into unstable (Mike Hommey)
[2026-06-10] Accepted firefox 151.0.4-1 (source) into unstable (Mike Hommey)
[2026-06-03] Accepted firefox 151.0.3-1 (source) into unstable (Mike Hommey)
[2026-05-26] Accepted firefox 151.0.2-1 (source) into unstable (Mike Hommey)
[2026-05-22] Accepted firefox 151.0.1-1 (source) into unstable (Mike Hommey)
[2026-05-20] Accepted firefox 151.0-1 (source) into unstable (Mike Hommey)
[2026-05-12] Accepted firefox 150.0.3-1 (source) into unstable (Mike Hommey)
[2026-05-08] Accepted firefox 150.0.2-1 (source) into unstable (Mike Hommey)
[2026-04-29] Accepted firefox 150.0.1-1 (source) into unstable (Debian FTP Masters) (signed by: Mike Hommey)

bugs [bug history graph]

all: 183 187
RC: 4 5
I&N: 137 140
M&W: 42
F&P: 0
patch: 16

links

lintian (3, 34)
buildd: logs, cross
popcon
browse source code
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:1snap1-0ubuntu11
637 bugs (13 patches)