Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package firefox-esr for openSUSE:Factory checked in at 2026-11-11 16:24:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/firefox-esr (Old) and /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "firefox-esr" Wed Nov 11 16:24:37 2026 rev:48 rq:1396541 version:153.7.0 Changes: -------- --- /work/SRC/openSUSE:Factory/firefox-esr/MozillaFirefox.changes 2026-10-28 17:46:46.822648473 +0100 +++ /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/MozillaFirefox.changes 2026-11-11 16:25:01.878121173 +0100 @@ -1,0 +2,191 @@ +Tue Nov 10 14:05:58 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.7.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.7.0 + https://www.mozilla.org/security/advisories/mfsa2026-127 + MFSA 2026-127 (boo#1289275) + * CVE-2026-124853 (bmo#2058035) + Sandbox escape due to incorrect boundary conditions in the + Graphics: Text component + * CVE-2026-124854 (bmo#2060230) + Privilege escalation in the DOM: Navigation component + * CVE-2026-124855 (bmo#2072096) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124856 (bmo#2072437) + Incorrect boundary conditions in the Networking: HTTP + component + * CVE-2026-124857 (bmo#2073695) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-124858 (bmo#2074172) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124859 (bmo#2074179) + Sandbox escape due to incorrect boundary conditions in the + Storage: Cache API component + * CVE-2026-124860 (bmo#2074194) + Use-after-free in the Audio/Video component + * CVE-2026-124861 (bmo#2074210) + Sandbox escape due to use-after-free in the Audio/Video: + cubeb component + * CVE-2026-124862 (bmo#2074220) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-118007 (bmo#2075296) + Use-after-free in the JavaScript: GC component + * CVE-2026-124863 (bmo#2075975) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124864 (bmo#2075976) + Sandbox escape due to use-after-free in the DOM: Service + Workers component + * CVE-2026-124865 (bmo#2076414) + Use-after-free in the Audio/Video component + * CVE-2026-124866 (bmo#2078993) + Use-after-free in the Layout component + * CVE-2026-124868 (bmo#2079169) + Incorrect boundary conditions in the DOM: Core & HTML + component + * CVE-2026-124869 (bmo#2079170) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124870 (bmo#2079466) + Incorrect boundary conditions in the JavaScript: GC component + * CVE-2026-124872 (bmo#2079689) + Use-after-free in the Cycle Collector component + * CVE-2026-124873 (bmo#2079937) + Invalid pointer in the DOM: Editor component + * CVE-2026-124874 (bmo#2080420) + Same-origin policy bypass in the Networking: HTTP component + * CVE-2026-124875 (bmo#2081380) + Incorrect boundary conditions in the DOM: CSS Object Model + component + * CVE-2026-124876 (bmo#2081550) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124877 (bmo#2081939) + Use-after-free in the Layout: Positioned component + * CVE-2026-124879 (bmo#2081949) + Invalid pointer in the Networking: Cache component + * CVE-2026-124880 (bmo#2081966) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124881 (bmo#2081980) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124882 (bmo#2081982) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124883 (bmo#2081991) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124884 (bmo#2081994) + Use-after-free in the JavaScript: GC component + * CVE-2026-124885 (bmo#2082006) + Use-after-free in the Graphics: Text component + * CVE-2026-124886 (bmo#2082021) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124887 (bmo#2082024) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124888 (bmo#2082025) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124889 (bmo#2082033) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124890 (bmo#2082039) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124891 (bmo#2082075) + Incorrect boundary conditions in the DOM: Selection component + * CVE-2026-124892 (bmo#2082083) + Use-after-free in the JavaScript: GC component + * CVE-2026-124893 (bmo#2082097) + Use-after-free in the DOM: Workers component + * CVE-2026-124894 (bmo#2082101) + Use-after-free in the Networking: Cookies component + * CVE-2026-124895 (bmo#2082109) + Use-after-free in the Storage: localStorage & sessionStorage + component + * CVE-2026-124896 (bmo#2082181) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124897 (bmo#2082186) + Use-after-free in the JavaScript: GC component + * CVE-2026-124898 (bmo#2082205) + Use-after-free in the DOM: Editor component + * CVE-2026-124899 (bmo#2082451) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-124901 (bmo#2083626) + Other issue in the Networking: JAR component + * CVE-2026-124902 (bmo#2083629) + Same-origin policy bypass due to race condition in the + Audio/Video component + * CVE-2026-124903 (bmo#2084673) + Sandbox escape due to use-after-free in the IPC component + * CVE-2026-124905 (bmo#2086254) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124906 (bmo#2086296) + Use-after-free in the Graphics: WebRender component + * CVE-2026-124907 (bmo#2087324) + Privilege escalation, sandbox escape due to use-after-free in + the Graphics: CanvasWebGL component + * CVE-2026-124909 (bmo#1730261) + Information disclosure in the Private Browsing component + * CVE-2026-124910 (bmo#1792485) + Mitigation bypass in the WebExtensions component + * CVE-2026-124912 (bmo#2025197) + Spoofing issue in the DOM: Security component + * CVE-2026-118019 (bmo#2025386) + Race condition, use-after-free in the DOM: File component + * CVE-2026-124913 (bmo#2045704) + Site isolation issue in the Networking component + * CVE-2026-124914 (bmo#2056107) + Site isolation issue in the DOM: Navigation component + * CVE-2026-124915 (bmo#2056172) + Incorrect boundary conditions in the Graphics: WebGPU + component + * CVE-2026-124917 (bmo#2058648) + Sandbox escape due to use-after-free in the Widget: Gtk + component + * CVE-2026-124918 (bmo#2058993) + Privilege escalation due to incorrect boundary conditions in + the Graphics: WebRender component + * CVE-2026-124919 (bmo#2061331) + Privilege escalation due to use-after-free in the WebRTC: + Networking component + * CVE-2026-124922 (bmo#2074190) + Use-after-free in the CSS Transitions and Animations + component + * CVE-2026-118021 (bmo#2076695) + Sandbox escape due to use-after-free in the XPCOM component + * CVE-2026-124924 (bmo#2076710) + Incorrect boundary conditions in the Graphics: WebRender + component + * CVE-2026-124926 (bmo#2077727) + Incorrect boundary conditions in the WebRTC component + * CVE-2026-124927 (bmo#2078669) + Site isolation issue in the Graphics: WebRender component + * CVE-2026-124929 (bmo#2080889) + Information disclosure in the Layout: Form Controls component + * CVE-2026-118024 (bmo#2081959) + Use-after-free in the Graphics: Text component + * CVE-2026-124930 (bmo#2082172) + Information disclosure in the Address Bar component + * CVE-2026-124931 (bmo#2083990) + Same-origin policy bypass in the DOM: Core & HTML component + * CVE-2026-124932 (bmo#2084555) + Use-after-free in the Graphics component + * CVE-2026-124933 (bmo#2085424) + Sandbox escape in the Console component + * CVE-2026-124934 (bmo#1847625) + Spoofing issue in the Security component + * CVE-2026-124935 (bmo#2061793) + Undefined behavior in the WebRTC: Networking component + * CVE-2026-124938 (bmo#2075948) + Mitigation bypass in the Add-ons Manager component + * CVE-2026-124939 (bmo#2076663) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-124940 (bmo#2076948) + Mitigation bypass in the File Handling component + * CVE-2026-124941 (bmo#2077405) + Information disclosure in the Security: RLBox component + * CVE-2026-124942 (bmo#2077728) + Invalid pointer in the DOM: Streams component + * CVE-2026-124948 (bmo#2081960) + Incorrect boundary conditions, use-after-free in the Graphics + component + * CVE-2026-124951 (bmo#2085124) + Privilege escalation in the Nimbus Desktop Client component +- Remove obsolete mozilla-bmo1746799.patch + +------------------------------------------------------------------- firefox-esr.changes: same change Old: ---- firefox-153.6.0esr.source.tar.xz firefox-153.6.0esr.source.tar.xz.asc l10n-153.6.0esr.tar.xz mozilla-bmo1746799.patch New: ---- firefox-153.7.0esr.source.tar.xz firefox-153.7.0esr.source.tar.xz.asc l10n-153.7.0esr.tar.xz ----------(Old B)---------- Old:/work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/MozillaFirefox.changes- Privilege escalation in the Nimbus Desktop Client component /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/MozillaFirefox.changes:- Remove obsolete mozilla-bmo1746799.patch /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/MozillaFirefox.changes- -- /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/firefox-esr.changes- Privilege escalation in the Nimbus Desktop Client component /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/firefox-esr.changes:- Remove obsolete mozilla-bmo1746799.patch /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/firefox-esr.changes- ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ firefox-esr.spec ++++++ --- /var/tmp/diff_new_pack.mTiRey/_old 2026-11-11 16:25:39.582702425 +0100 +++ /var/tmp/diff_new_pack.mTiRey/_new 2026-11-11 16:25:39.585702551 +0100 @@ -41,8 +41,8 @@ # major 69 # mainver %%major.99 %define major 153 -%define mainver %major.6.0 -%define orig_version 153.6.0 +%define mainver %major.7.0 +%define orig_version 153.7.0 %define orig_suffix esr %define update_channel esr %define branding 1 @@ -246,7 +246,6 @@ Patch18: mozilla-silence-no-return-type.patch Patch20: one_swizzle_to_rule_them_all.patch Patch21: svg-rendering.patch -Patch24: mozilla-bmo1746799.patch Patch25: mozilla-sandbox-lto.patch Patch26: mozilla-bmo2030493.patch Patch28: mozilla-bmo2048250.patch ++++++ MozillaFirefox.changes.txt ++++++ --- /var/tmp/diff_new_pack.mTiRey/_old 2026-11-11 16:25:39.935717230 +0100 +++ /var/tmp/diff_new_pack.mTiRey/_new 2026-11-11 16:25:39.951717901 +0100 @@ -1,4 +1,195 @@ ------------------------------------------------------------------- +Tue Nov 10 14:05:58 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.7.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.7.0 + https://www.mozilla.org/security/advisories/mfsa2026-127 + MFSA 2026-127 (boo#1289275) + * CVE-2026-124853 (bmo#2058035) + Sandbox escape due to incorrect boundary conditions in the + Graphics: Text component + * CVE-2026-124854 (bmo#2060230) + Privilege escalation in the DOM: Navigation component + * CVE-2026-124855 (bmo#2072096) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124856 (bmo#2072437) + Incorrect boundary conditions in the Networking: HTTP + component + * CVE-2026-124857 (bmo#2073695) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-124858 (bmo#2074172) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124859 (bmo#2074179) + Sandbox escape due to incorrect boundary conditions in the + Storage: Cache API component + * CVE-2026-124860 (bmo#2074194) + Use-after-free in the Audio/Video component + * CVE-2026-124861 (bmo#2074210) + Sandbox escape due to use-after-free in the Audio/Video: + cubeb component + * CVE-2026-124862 (bmo#2074220) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-118007 (bmo#2075296) + Use-after-free in the JavaScript: GC component + * CVE-2026-124863 (bmo#2075975) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124864 (bmo#2075976) + Sandbox escape due to use-after-free in the DOM: Service + Workers component + * CVE-2026-124865 (bmo#2076414) + Use-after-free in the Audio/Video component + * CVE-2026-124866 (bmo#2078993) + Use-after-free in the Layout component + * CVE-2026-124868 (bmo#2079169) + Incorrect boundary conditions in the DOM: Core & HTML + component + * CVE-2026-124869 (bmo#2079170) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124870 (bmo#2079466) + Incorrect boundary conditions in the JavaScript: GC component + * CVE-2026-124872 (bmo#2079689) + Use-after-free in the Cycle Collector component + * CVE-2026-124873 (bmo#2079937) + Invalid pointer in the DOM: Editor component + * CVE-2026-124874 (bmo#2080420) + Same-origin policy bypass in the Networking: HTTP component + * CVE-2026-124875 (bmo#2081380) + Incorrect boundary conditions in the DOM: CSS Object Model + component + * CVE-2026-124876 (bmo#2081550) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124877 (bmo#2081939) + Use-after-free in the Layout: Positioned component + * CVE-2026-124879 (bmo#2081949) + Invalid pointer in the Networking: Cache component + * CVE-2026-124880 (bmo#2081966) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124881 (bmo#2081980) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124882 (bmo#2081982) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124883 (bmo#2081991) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124884 (bmo#2081994) + Use-after-free in the JavaScript: GC component + * CVE-2026-124885 (bmo#2082006) + Use-after-free in the Graphics: Text component + * CVE-2026-124886 (bmo#2082021) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124887 (bmo#2082024) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124888 (bmo#2082025) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124889 (bmo#2082033) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124890 (bmo#2082039) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124891 (bmo#2082075) + Incorrect boundary conditions in the DOM: Selection component + * CVE-2026-124892 (bmo#2082083) + Use-after-free in the JavaScript: GC component + * CVE-2026-124893 (bmo#2082097) + Use-after-free in the DOM: Workers component + * CVE-2026-124894 (bmo#2082101) + Use-after-free in the Networking: Cookies component + * CVE-2026-124895 (bmo#2082109) + Use-after-free in the Storage: localStorage & sessionStorage + component + * CVE-2026-124896 (bmo#2082181) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124897 (bmo#2082186) + Use-after-free in the JavaScript: GC component + * CVE-2026-124898 (bmo#2082205) + Use-after-free in the DOM: Editor component + * CVE-2026-124899 (bmo#2082451) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-124901 (bmo#2083626) + Other issue in the Networking: JAR component + * CVE-2026-124902 (bmo#2083629) + Same-origin policy bypass due to race condition in the + Audio/Video component + * CVE-2026-124903 (bmo#2084673) + Sandbox escape due to use-after-free in the IPC component + * CVE-2026-124905 (bmo#2086254) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124906 (bmo#2086296) + Use-after-free in the Graphics: WebRender component + * CVE-2026-124907 (bmo#2087324) + Privilege escalation, sandbox escape due to use-after-free in + the Graphics: CanvasWebGL component + * CVE-2026-124909 (bmo#1730261) + Information disclosure in the Private Browsing component + * CVE-2026-124910 (bmo#1792485) + Mitigation bypass in the WebExtensions component + * CVE-2026-124912 (bmo#2025197) + Spoofing issue in the DOM: Security component + * CVE-2026-118019 (bmo#2025386) + Race condition, use-after-free in the DOM: File component + * CVE-2026-124913 (bmo#2045704) + Site isolation issue in the Networking component + * CVE-2026-124914 (bmo#2056107) + Site isolation issue in the DOM: Navigation component + * CVE-2026-124915 (bmo#2056172) + Incorrect boundary conditions in the Graphics: WebGPU + component + * CVE-2026-124917 (bmo#2058648) + Sandbox escape due to use-after-free in the Widget: Gtk + component + * CVE-2026-124918 (bmo#2058993) + Privilege escalation due to incorrect boundary conditions in + the Graphics: WebRender component + * CVE-2026-124919 (bmo#2061331) + Privilege escalation due to use-after-free in the WebRTC: + Networking component + * CVE-2026-124922 (bmo#2074190) + Use-after-free in the CSS Transitions and Animations + component + * CVE-2026-118021 (bmo#2076695) + Sandbox escape due to use-after-free in the XPCOM component + * CVE-2026-124924 (bmo#2076710) + Incorrect boundary conditions in the Graphics: WebRender + component + * CVE-2026-124926 (bmo#2077727) + Incorrect boundary conditions in the WebRTC component + * CVE-2026-124927 (bmo#2078669) + Site isolation issue in the Graphics: WebRender component + * CVE-2026-124929 (bmo#2080889) + Information disclosure in the Layout: Form Controls component + * CVE-2026-118024 (bmo#2081959) + Use-after-free in the Graphics: Text component + * CVE-2026-124930 (bmo#2082172) + Information disclosure in the Address Bar component + * CVE-2026-124931 (bmo#2083990) + Same-origin policy bypass in the DOM: Core & HTML component + * CVE-2026-124932 (bmo#2084555) + Use-after-free in the Graphics component + * CVE-2026-124933 (bmo#2085424) + Sandbox escape in the Console component + * CVE-2026-124934 (bmo#1847625) + Spoofing issue in the Security component + * CVE-2026-124935 (bmo#2061793) + Undefined behavior in the WebRTC: Networking component + * CVE-2026-124938 (bmo#2075948) + Mitigation bypass in the Add-ons Manager component + * CVE-2026-124939 (bmo#2076663) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-124940 (bmo#2076948) + Mitigation bypass in the File Handling component + * CVE-2026-124941 (bmo#2077405) + Information disclosure in the Security: RLBox component + * CVE-2026-124942 (bmo#2077728) + Invalid pointer in the DOM: Streams component + * CVE-2026-124948 (bmo#2081960) + Incorrect boundary conditions, use-after-free in the Graphics + component + * CVE-2026-124951 (bmo#2085124) + Privilege escalation in the Nimbus Desktop Client component +- Remove obsolete mozilla-bmo1746799.patch + +------------------------------------------------------------------- Tue Oct 27 14:04:38 UTC 2026 - Manfred Hollstein <[email protected]> - Firefox Extended Support Release 153.6.0 ESR ++++++ firefox-153.6.0esr.source.tar.xz -> firefox-153.7.0esr.source.tar.xz ++++++ /work/SRC/openSUSE:Factory/firefox-esr/firefox-153.6.0esr.source.tar.xz /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/firefox-153.7.0esr.source.tar.xz differ: char 15, line 1 ++++++ firefox-esr.changes.txt ++++++ --- /var/tmp/diff_new_pack.mTiRey/_old 2026-11-11 16:25:40.285731909 +0100 +++ /var/tmp/diff_new_pack.mTiRey/_new 2026-11-11 16:25:40.309732915 +0100 @@ -1,4 +1,195 @@ ------------------------------------------------------------------- +Tue Nov 10 14:05:58 UTC 2026 - Manfred Hollstein <[email protected]> + +- Firefox Extended Support Release 153.7.0 ESR + * Fixed: Various security fixes. +- Mozilla Firefox ESR 153.7.0 + https://www.mozilla.org/security/advisories/mfsa2026-127 + MFSA 2026-127 (boo#1289275) + * CVE-2026-124853 (bmo#2058035) + Sandbox escape due to incorrect boundary conditions in the + Graphics: Text component + * CVE-2026-124854 (bmo#2060230) + Privilege escalation in the DOM: Navigation component + * CVE-2026-124855 (bmo#2072096) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124856 (bmo#2072437) + Incorrect boundary conditions in the Networking: HTTP + component + * CVE-2026-124857 (bmo#2073695) + Use-after-free in the Graphics: Canvas2D component + * CVE-2026-124858 (bmo#2074172) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124859 (bmo#2074179) + Sandbox escape due to incorrect boundary conditions in the + Storage: Cache API component + * CVE-2026-124860 (bmo#2074194) + Use-after-free in the Audio/Video component + * CVE-2026-124861 (bmo#2074210) + Sandbox escape due to use-after-free in the Audio/Video: + cubeb component + * CVE-2026-124862 (bmo#2074220) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-118007 (bmo#2075296) + Use-after-free in the JavaScript: GC component + * CVE-2026-124863 (bmo#2075975) + Use-after-free in the DOM: HTML Parser component + * CVE-2026-124864 (bmo#2075976) + Sandbox escape due to use-after-free in the DOM: Service + Workers component + * CVE-2026-124865 (bmo#2076414) + Use-after-free in the Audio/Video component + * CVE-2026-124866 (bmo#2078993) + Use-after-free in the Layout component + * CVE-2026-124868 (bmo#2079169) + Incorrect boundary conditions in the DOM: Core & HTML + component + * CVE-2026-124869 (bmo#2079170) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124870 (bmo#2079466) + Incorrect boundary conditions in the JavaScript: GC component + * CVE-2026-124872 (bmo#2079689) + Use-after-free in the Cycle Collector component + * CVE-2026-124873 (bmo#2079937) + Invalid pointer in the DOM: Editor component + * CVE-2026-124874 (bmo#2080420) + Same-origin policy bypass in the Networking: HTTP component + * CVE-2026-124875 (bmo#2081380) + Incorrect boundary conditions in the DOM: CSS Object Model + component + * CVE-2026-124876 (bmo#2081550) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124877 (bmo#2081939) + Use-after-free in the Layout: Positioned component + * CVE-2026-124879 (bmo#2081949) + Invalid pointer in the Networking: Cache component + * CVE-2026-124880 (bmo#2081966) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124881 (bmo#2081980) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124882 (bmo#2081982) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124883 (bmo#2081991) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124884 (bmo#2081994) + Use-after-free in the JavaScript: GC component + * CVE-2026-124885 (bmo#2082006) + Use-after-free in the Graphics: Text component + * CVE-2026-124886 (bmo#2082021) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124887 (bmo#2082024) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124888 (bmo#2082025) + Incorrect boundary conditions in the Layout: Text and Fonts + component + * CVE-2026-124889 (bmo#2082033) + Use-after-free in the CSS Parsing and Computation component + * CVE-2026-124890 (bmo#2082039) + Use-after-free in the DOM: Core & HTML component + * CVE-2026-124891 (bmo#2082075) + Incorrect boundary conditions in the DOM: Selection component + * CVE-2026-124892 (bmo#2082083) + Use-after-free in the JavaScript: GC component + * CVE-2026-124893 (bmo#2082097) + Use-after-free in the DOM: Workers component + * CVE-2026-124894 (bmo#2082101) + Use-after-free in the Networking: Cookies component + * CVE-2026-124895 (bmo#2082109) + Use-after-free in the Storage: localStorage & sessionStorage + component + * CVE-2026-124896 (bmo#2082181) + Invalid pointer in the Layout: Text and Fonts component + * CVE-2026-124897 (bmo#2082186) + Use-after-free in the JavaScript: GC component + * CVE-2026-124898 (bmo#2082205) + Use-after-free in the DOM: Editor component + * CVE-2026-124899 (bmo#2082451) + Use-after-free in the Layout: Text and Fonts component + * CVE-2026-124901 (bmo#2083626) + Other issue in the Networking: JAR component + * CVE-2026-124902 (bmo#2083629) + Same-origin policy bypass due to race condition in the + Audio/Video component + * CVE-2026-124903 (bmo#2084673) + Sandbox escape due to use-after-free in the IPC component + * CVE-2026-124905 (bmo#2086254) + Sandbox escape in the DOM: Navigation component + * CVE-2026-124906 (bmo#2086296) + Use-after-free in the Graphics: WebRender component + * CVE-2026-124907 (bmo#2087324) + Privilege escalation, sandbox escape due to use-after-free in + the Graphics: CanvasWebGL component + * CVE-2026-124909 (bmo#1730261) + Information disclosure in the Private Browsing component + * CVE-2026-124910 (bmo#1792485) + Mitigation bypass in the WebExtensions component + * CVE-2026-124912 (bmo#2025197) + Spoofing issue in the DOM: Security component + * CVE-2026-118019 (bmo#2025386) + Race condition, use-after-free in the DOM: File component + * CVE-2026-124913 (bmo#2045704) + Site isolation issue in the Networking component + * CVE-2026-124914 (bmo#2056107) + Site isolation issue in the DOM: Navigation component + * CVE-2026-124915 (bmo#2056172) + Incorrect boundary conditions in the Graphics: WebGPU + component + * CVE-2026-124917 (bmo#2058648) + Sandbox escape due to use-after-free in the Widget: Gtk + component + * CVE-2026-124918 (bmo#2058993) + Privilege escalation due to incorrect boundary conditions in + the Graphics: WebRender component + * CVE-2026-124919 (bmo#2061331) + Privilege escalation due to use-after-free in the WebRTC: + Networking component + * CVE-2026-124922 (bmo#2074190) + Use-after-free in the CSS Transitions and Animations + component + * CVE-2026-118021 (bmo#2076695) + Sandbox escape due to use-after-free in the XPCOM component + * CVE-2026-124924 (bmo#2076710) + Incorrect boundary conditions in the Graphics: WebRender + component + * CVE-2026-124926 (bmo#2077727) + Incorrect boundary conditions in the WebRTC component + * CVE-2026-124927 (bmo#2078669) + Site isolation issue in the Graphics: WebRender component + * CVE-2026-124929 (bmo#2080889) + Information disclosure in the Layout: Form Controls component + * CVE-2026-118024 (bmo#2081959) + Use-after-free in the Graphics: Text component + * CVE-2026-124930 (bmo#2082172) + Information disclosure in the Address Bar component + * CVE-2026-124931 (bmo#2083990) + Same-origin policy bypass in the DOM: Core & HTML component + * CVE-2026-124932 (bmo#2084555) + Use-after-free in the Graphics component + * CVE-2026-124933 (bmo#2085424) + Sandbox escape in the Console component + * CVE-2026-124934 (bmo#1847625) + Spoofing issue in the Security component + * CVE-2026-124935 (bmo#2061793) + Undefined behavior in the WebRTC: Networking component + * CVE-2026-124938 (bmo#2075948) + Mitigation bypass in the Add-ons Manager component + * CVE-2026-124939 (bmo#2076663) + JIT miscompilation in the JavaScript Engine: JIT component + * CVE-2026-124940 (bmo#2076948) + Mitigation bypass in the File Handling component + * CVE-2026-124941 (bmo#2077405) + Information disclosure in the Security: RLBox component + * CVE-2026-124942 (bmo#2077728) + Invalid pointer in the DOM: Streams component + * CVE-2026-124948 (bmo#2081960) + Incorrect boundary conditions, use-after-free in the Graphics + component + * CVE-2026-124951 (bmo#2085124) + Privilege escalation in the Nimbus Desktop Client component +- Remove obsolete mozilla-bmo1746799.patch + +------------------------------------------------------------------- Tue Oct 27 14:04:38 UTC 2026 - Manfred Hollstein <[email protected]> - Firefox Extended Support Release 153.6.0 ESR ++++++ l10n-153.6.0esr.tar.xz -> l10n-153.7.0esr.tar.xz ++++++ /work/SRC/openSUSE:Factory/firefox-esr/l10n-153.6.0esr.tar.xz /work/SRC/openSUSE:Factory/.firefox-esr.new.3759290/l10n-153.7.0esr.tar.xz differ: char 15, line 1 ++++++ tar_stamps ++++++ --- /var/tmp/diff_new_pack.mTiRey/_old 2026-11-11 16:25:40.898757618 +0100 +++ /var/tmp/diff_new_pack.mTiRey/_new 2026-11-11 16:25:40.906757953 +0100 @@ -1,11 +1,11 @@ PRODUCT="firefox" CHANNEL="esr153" -VERSION="153.6.0" +VERSION="153.7.0" VERSION_SUFFIX="esr" -PREV_VERSION="153.5.1" +PREV_VERSION="153.6.0" PREV_VERSION_SUFFIX="esr" #SKIP_LOCALES="" # Uncomment to skip l10n and compare-locales-generation RELEASE_REPO="https://hg.mozilla.org/releases/mozilla-esr153"; -RELEASE_TAG="d63de7b9609253a860fbb0050f678700f4cdc492" -RELEASE_TIMESTAMP="20261022211647" +RELEASE_TAG="a9effd9e521653405f0ffd311e8edf90bde92237" +RELEASE_TIMESTAMP="20261103151912"
