CVS commit: pkgsrc/www/firefox140

["David H. Gutteridge" <gutteridge%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Tue Sep 15 13:16:58 UTC 2026

Modified Files:
        pkgsrc/www/firefox140: Makefile distinfo

Log Message:
firefox140: update to 140.16

Mozilla Foundation Security Advisory 2026-92
Security Vulnerabilities fixed in Firefox ESR 140.16

Announced
    September 15, 2026
Impact
    high
Products
    Firefox ESR
Fixed in

        Firefox ESR 140.16

Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.
#CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component

Reporter
    devdharan9424%gmail.com@localhost
Impact
    high

References

    Bug 2056051

#CVE-2026-92006: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2057121

#CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058064

#CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058065

#CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058066

#CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058067

#CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058068

#CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058069

#CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Reporter
    Mozilla
Impact
    high

References

    Bug 2058078

#CVE-2026-92014: Privilege escalation due to incorrect boundary conditions in the Graphics component

Reporter
    Jacolon Walker
Impact
    high

References

    Bug 2060000

#CVE-2026-92015: Privilege escalation in the WebExtensions component

Reporter
    Quy Pham
Impact
    high

References

    Bug 2060235

#CVE-2026-92016: Use-after-free in the Disability Access APIs component

Reporter
    Mozilla
Impact
    high

References

    Bug 2061327

#CVE-2026-92017: Privilege escalation in the DOM: Service Workers component

Reporter
    Mozilla
Impact
    high

References

    Bug 2061777

#CVE-2026-92018: Sandbox escape in the DOM: Core & HTML component

Reporter
    Quy Pham
Impact
    high

References

    Bug 2064287

#CVE-2026-92019: Mitigation bypass in the Remote Settings Client component

Reporter
    Shu Takahashi
Impact
    high

References

    Bug 2065636

#CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component

Reporter
    Rintaro Kawasugi
Impact
    high

References

    Bug 2066329

#CVE-2026-92021: Use-after-free in the JavaScript Engine: JIT component

Reporter
    Tomer Fichman
Impact
    high

References

    Bug 2067208

#CVE-2026-92022: Use-after-free in the DOM: HTML Parser component

Reporter
    Seohyeon Maeng
Impact
    high

References

    Bug 2068059

#CVE-2026-92023: Use-after-free in the XML component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068342

#CVE-2026-92024: Use-after-free in the SVG component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068354

#CVE-2026-92025: Use-after-free in the DOM: Navigation component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068361

#CVE-2026-92026: Use-after-free in the Networking component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068378

#CVE-2026-92027: Use-after-free in the DOM: Streams component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068433

#CVE-2026-92028: Use-after-free in the DOM: Core & HTML component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068440

#CVE-2026-92029: Use-after-free in the SVG component

Reporter
    Mozilla
Impact
    high

References

    Bug 2068445

#CVE-2026-92030: Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component

Reporter
    anas cherni
Impact
    moderate

References

    Bug 2058417

#CVE-2026-92031: Information disclosure in the Graphics: ImageLib component

Reporter
    Qi Qin
Impact
    moderate

References

    Bug 2067971

#CVE-2026-92032: Sandbox escape due to invalid pointer in the Graphics component

Reporter
    Mozilla
Impact
    moderate

References

    Bug 2068437


To generate a diff of this commit:
cvs rdiff -u -r1.24 -r1.25 pkgsrc/www/firefox140/Makefile
cvs rdiff -u -r1.21 -r1.22 pkgsrc/www/firefox140/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox140/Makefile
diff -u pkgsrc/www/firefox140/Makefile:1.24 pkgsrc/www/firefox140/Makefile:1.25
--- pkgsrc/www/firefox140/Makefile:1.24 Wed Sep  2 19:04:57 2026
+++ pkgsrc/www/firefox140/Makefile      Tue Sep 15 13:16:58 2026
@@ -1,12 +1,11 @@
-# $NetBSD: Makefile,v 1.24 2026/09/02 19:04:57 wiz Exp $
+# $NetBSD: Makefile,v 1.25 2026/09/15 13:16:58 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            140.15
+MOZ_BRANCH=            140.16
 MOZ_BRANCH_MINOR=      .0esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox140-/}
-PKGREVISION=   1
 CATEGORIES=    www
 MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}

Index: pkgsrc/www/firefox140/distinfo
diff -u pkgsrc/www/firefox140/distinfo:1.21 pkgsrc/www/firefox140/distinfo:1.22
--- pkgsrc/www/firefox140/distinfo:1.21 Tue Sep  1 16:02:34 2026
+++ pkgsrc/www/firefox140/distinfo      Tue Sep 15 13:16:58 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.21 2026/09/01 16:02:34 gutteridge Exp $
+$NetBSD: distinfo,v 1.22 2026/09/15 13:16:58 gutteridge Exp $
 
-BLAKE2s (firefox-140.15.0esr.source.tar.xz) = 6a82557345fb1b797bea278dd84fda29fcb4c19be1f579c08b082a3b3b191b78
-SHA512 (firefox-140.15.0esr.source.tar.xz) = c3a9c92776fc0fe4ec84e83d608822a84ab424bef3e9200de8e17f161369d13bb4a5caf5de326dded23edaf1c6b424d831218029786d4cfd1d857ee2634efeff
-Size (firefox-140.15.0esr.source.tar.xz) = 640054332 bytes
+BLAKE2s (firefox-140.16.0esr.source.tar.xz) = 787602619860678dbde4ff0ebe59db1f2a0920835b9fe6a523ac8ff7947b04d2
+SHA512 (firefox-140.16.0esr.source.tar.xz) = fabf5b481594a9a860b6ae379d2ee89ba291b807c94334ee15bad1fe862edb47c22e890d892e33d6a6ec57fce4ab12aa9c9c6fa4a501b881ecc6211ac04bd9a0
+Size (firefox-140.16.0esr.source.tar.xz) = 632581380 bytes
 BLAKE2s (nodejs-output-140.0.4.tgz) = 7ebb5993c8c9d7d5492afdb9fa7fef74fec7753fb0b14673817f24faf4a7fca4
 SHA512 (nodejs-output-140.0.4.tgz) = e421b0b6be8b5b8dfda705eefcf4573a1270df9012dca5eac9ba0ac2af2bcc47dd66b1057106f8c2336a10bdcc39b9f852041dd33da9e7a8929d981dbb4e1fb4
 Size (nodejs-output-140.0.4.tgz) = 245385 bytes