File _patchinfo of Package patchinfo.43365

<patchinfo incident="43365">
  <!--generated with prepare-update from request 404415-->
  <issue tracker="bnc" id="1260083">VUL-0: MozillaFirefox / MozillaThunderbird: update to 149.0 and 140.9esr</issue>
  <issue tracker="cve" id="2025-59375"/>
  <issue tracker="cve" id="2026-4684"/>
  <issue tracker="cve" id="2026-4685"/>
  <issue tracker="cve" id="2026-4686"/>
  <issue tracker="cve" id="2026-4687"/>
  <issue tracker="cve" id="2026-4688"/>
  <issue tracker="cve" id="2026-4689"/>
  <issue tracker="cve" id="2026-4690"/>
  <issue tracker="cve" id="2026-4691"/>
  <issue tracker="cve" id="2026-4692"/>
  <issue tracker="cve" id="2026-4693"/>
  <issue tracker="cve" id="2026-4694"/>
  <issue tracker="cve" id="2026-4695"/>
  <issue tracker="cve" id="2026-4696"/>
  <issue tracker="cve" id="2026-4697"/>
  <issue tracker="cve" id="2026-4698"/>
  <issue tracker="cve" id="2026-4699"/>
  <issue tracker="cve" id="2026-4700"/>
  <issue tracker="cve" id="2026-4701"/>
  <issue tracker="cve" id="2026-4702"/>
  <issue tracker="cve" id="2026-4704"/>
  <issue tracker="cve" id="2026-4705"/>
  <issue tracker="cve" id="2026-4706"/>
  <issue tracker="cve" id="2026-4707"/>
  <issue tracker="cve" id="2026-4708"/>
  <issue tracker="cve" id="2026-4709"/>
  <issue tracker="cve" id="2026-4710"/>
  <issue tracker="cve" id="2026-4711"/>
  <issue tracker="cve" id="2026-4712"/>
  <issue tracker="cve" id="2026-4713"/>
  <issue tracker="cve" id="2026-4714"/>
  <issue tracker="cve" id="2026-4715"/>
  <issue tracker="cve" id="2026-4716"/>
  <issue tracker="cve" id="2026-4717"/>
  <issue tracker="cve" id="2026-4718"/>
  <issue tracker="cve" id="2026-4719"/>
  <issue tracker="cve" id="2026-4720"/>
  <issue tracker="cve" id="2026-4721"/>
  <category>security</category>
  <rating>important</rating>
  <packager>MSirringhaus</packager>
  <summary>Security update for MozillaFirefox</summary>
  <description>This update for MozillaFirefox fixes the following issues:

Update to Firefox 140.9.0 ESR (MFSA 2026-22, bsc#1260083):

  - CVE-2026-4684: Race condition, use-after-free in the Graphics: WebRender component
  - CVE-2026-4685: Incorrect boundary conditions in the Graphics: Canvas2D component
  - CVE-2026-4686: Incorrect boundary conditions in the Graphics: Canvas2D component
  - CVE-2026-4687: Sandbox escape due to incorrect boundary conditions in the Telemetry component
  - CVE-2026-4688: Sandbox escape due to use-after-free in the Disability Access APIs component
  - CVE-2026-4689: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
  - CVE-2026-4690: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component
  - CVE-2026-4691: Use-after-free in the CSS Parsing and Computation component
  - CVE-2026-4692: Sandbox escape in the Responsive Design Mode component
  - CVE-2026-4693: Incorrect boundary conditions in the Audio/Video: Playback component
  - CVE-2026-4694: Incorrect boundary conditions, integer overflow in the Graphics component
  - CVE-2026-4695: Incorrect boundary conditions in the Audio/Video: Web Codecs component
  - CVE-2026-4696: Use-after-free in the Layout: Text and Fonts component
  - CVE-2026-4697: Incorrect boundary conditions in the Audio/Video: Web Codecs component
  - CVE-2026-4698: JIT miscompilation in the JavaScript Engine: JIT component
  - CVE-2026-4699: Incorrect boundary conditions in the Layout: Text and Fonts component
  - CVE-2026-4700: Mitigation bypass in the Networking: HTTP component
  - CVE-2026-4701: Use-after-free in the JavaScript Engine component
  - CVE-2026-4702: JIT miscompilation in the JavaScript Engine component
  - CVE-2026-4704: Denial-of-service in the WebRTC: Signaling component
  - CVE-2026-4705: Undefined behavior in the WebRTC: Signaling component
  - CVE-2026-4706: Incorrect boundary conditions in the Graphics: Canvas2D component
  - CVE-2026-4707: Incorrect boundary conditions in the Graphics: Canvas2D component
  - CVE-2026-4708: Incorrect boundary conditions in the Graphics component
  - CVE-2026-4709: Incorrect boundary conditions in the Audio/Video: GMP component
  - CVE-2026-4710: Incorrect boundary conditions in the Audio/Video component
  - CVE-2026-4711: Use-after-free in the Widget: Cocoa component
  - CVE-2026-4712: Information disclosure in the Widget: Cocoa component
  - CVE-2026-4713: Incorrect boundary conditions in the Graphics component
  - CVE-2026-4714: Incorrect boundary conditions in the Audio/Video component
  - CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D component
  - CVE-2026-4716: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component
  - CVE-2026-4717: Privilege escalation in the Netmonitor component
  - CVE-2025-59375: Denial-of-service in the XML component
  - CVE-2026-4718: Undefined behavior in the WebRTC: Signaling component
  - CVE-2026-4719: Incorrect boundary conditions in the Graphics: Text component
  - CVE-2026-4720: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and
    Thunderbird 149
  - CVE-2026-4721: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9,
    Firefox 149 and Thunderbird 149
</description>
</patchinfo>