CVS commit: pkgsrc/www/firefox153

To: pkgsrc-changes%NetBSD.org@localhost
Subject: CVS commit: pkgsrc/www/firefox153
From: "David H. Gutteridge" <gutteridge%netbsd.org@localhost>
Date: Tue, 13 Oct 2026 13:11:04 +0000

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Tue Oct 13 13:11:04 UTC 2026

Modified Files:
        pkgsrc/www/firefox153: Makefile distinfo

Log Message:
firefox153: update to 153.5

Mozilla Foundation Security Advisory 2026-108

Security Vulnerabilities fixed in Firefox ESR 153.5

Announced
October 13, 2026
Impact
high
Products
Firefox ESR
Fixed in
Firefox ESR 153.5
Note: We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug.

#CVE-2026-109704: Privilege escalation in the Application Update component

Reporter
Noel
Impact
high
References

Bug 2037979
#CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component

Reporter
Mozilla
Impact
high
References

Bug 2040905
#CVE-2026-109706: Use-after-free in the Storage: IndexedDB component

Reporter
Mozilla
Impact
high
References

Bug 2053649
#CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component

Reporter
Mozilla
Impact
high
References

Bug 2059150
#CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component

Reporter
Mozilla
Impact
high
References

Bug 2059151
#CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing component

Reporter
Yaqoub Aldurayhim
Impact
high
References

Bug 2067976
#CVE-2026-109710: Use-after-free in the Graphics: Text component

Reporter
Mozilla
Impact
high
References

Bug 2068338
#CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component

Reporter
Mozilla
Impact
high
References

Bug 2068344
#CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component

Reporter
Mozilla
Impact
high
References

Bug 2068420
#CVE-2026-109713: Use-after-free in the Crash Reporting component

Reporter
locust1b
Impact
high
References

Bug 2068421
#CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2073267
#CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2073269
#CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component

Reporter
Mozilla
Impact
high
References

Bug 2073647
#CVE-2026-109718: Use-after-free in the XML component

Reporter
Mozilla
Impact
high
References

Bug 2073692
#CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component

Reporter
Shu Takahashi of Velcore Consulting Inc.
Impact
high
References

Bug 2073969
#CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2074160
#CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2074161
#CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2074164
#CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2074171
#CVE-2026-109724: Use-after-free in the DOM: Core & HTML component

Reporter
Mozilla
Impact
high
References

Bug 2074193
#CVE-2026-109725: Use-after-free in the DOM: Core & HTML component

Reporter
Mozilla
Impact
high
References

Bug 2074208
#CVE-2026-109726: Use-after-free in the SVG component

Reporter
Mozilla
Impact
high
References

Bug 2074212
#CVE-2026-109727: Use-after-free in the Audio/Video component

Reporter
Mozilla
Impact
high
References

Bug 2074213
#CVE-2026-109728: Use-after-free in the DOM: Animation component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2074625
#CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component

Reporter
Tomer Fichman
Impact
high
References

Bug 2074632
#CVE-2026-109730: Integer overflow in the Graphics component

Reporter
Robert Longson
Impact
high
References

Bug 2074896
#CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2075436
#CVE-2026-109732: Use-after-free in the DOM: Streams component

Reporter
Mozilla
Impact
high
References

Bug 2075998
#CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component

Reporter
Amy Burnett of OpenAI
Impact
high
References

Bug 2076269
#CVE-2026-109734: Mitigation bypass in the DOM: Security component

Reporter
Mirko Brodesser
Impact
moderate
References

Bug 1926318
#CVE-2026-109736: Frame poisoning in the Layout component

Reporter
Mozilla
Impact
moderate
References

Bug 2029784
#CVE-2026-109737: Mitigation bypass in the Enterprise Policies component

Reporter
Souma Ohsawa
Impact
moderate
References

Bug 2044525
#CVE-2026-109738: Use-after-free in the Audio/Video: Playback component

Reporter
Mozilla
Impact
moderate
References

Bug 2047722
#CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component

Reporter
Mozilla
Impact
moderate
References

Bug 2057113
#CVE-2026-109741: Use-after-free in the Storage: Bucket File System component

Reporter
Mozilla
Impact
moderate
References

Bug 2058651
#CVE-2026-109742: Information disclosure in the PDF Viewer component

Reporter
Mozilla
Impact
moderate
References

Bug 2058800
#CVE-2026-109743: Privilege escalation in the Panning and Zooming component

Reporter
Mozilla
Impact
moderate
References

Bug 2059195
#CVE-2026-109744: Other issue in the DOM: File component

Reporter
Mozilla
Impact
moderate
References

Bug 2059211
#CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component

Reporter
Mozilla
Impact
moderate
References

Bug 2061784
#CVE-2026-109782: Mitigation bypass in the File Handling component

Reporter
Abdulrahman Alzahrani
Impact
moderate
References

Bug 2067465
#CVE-2026-109751: Information disclosure in the Networking component

Reporter
Mozilla
Impact
moderate
References

Bug 2068372
#CVE-2026-109752: Use-after-free in the DOM: Workers component

Reporter
Mozilla
Impact
moderate
References

Bug 2068407
#CVE-2026-109753: Incorrect boundary conditions in the Layout component

Reporter
Mozilla
Impact
moderate
References

Bug 2068441
#CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component

Reporter
Mozilla
Impact
moderate
References

Bug 2068443
#CVE-2026-109756: Privilege escalation in the DOM: Navigation component

Reporter
Mozilla
Impact
moderate
References

Bug 2069258
#CVE-2026-109757: Sandbox escape due to race condition in the Networking component

Reporter
Yaqoub Aldurayhim
Impact
moderate
References

Bug 2069910
#CVE-2026-109759: Site isolation issue in the Networking component

Reporter
Myungyong Lee
Impact
moderate
References

Bug 2070252
#CVE-2026-109760: Mitigation bypass in the Networking: HTTP component

Reporter
Myungyong Lee
Impact
moderate
References

Bug 2070633
#CVE-2026-109762: Incorrect boundary conditions in the SVG component

Reporter
Mozilla
Impact
moderate
References

Bug 2072438
#CVE-2026-109763: Mitigation bypass in the File Handling component

Reporter
Riku Bamba
Impact
moderate
References

Bug 2072501
#CVE-2026-109764: Mitigation bypass in the Enterprise Policies component

Reporter
HyeonSeung Kim
Impact
moderate
References

Bug 2073382
#CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component

Reporter
Shu Takahashi of Velcore Consulting Inc.
Impact
moderate
References

Bug 2073396
#CVE-2026-109766: Mitigation bypass in the Enterprise Policies component

Reporter
Souma Ohsawa
Impact
moderate
References

Bug 2074406
#CVE-2026-109767: Information disclosure in the Networking component

Reporter
Mozilla
Impact
moderate
References

Bug 2074963
#CVE-2026-109783: Mitigation bypass in the File Handling component

Reporter
Mozilla
Impact
moderate
References

Bug 2075533
#CVE-2026-109770: Spoofing issue in the DOM: Web Serial component

Reporter
Mozilla
Impact
low
References

Bug 2059230
#CVE-2026-109775: Denial-of-service in the WebRTC component

Reporter
Shu Takahashi of Velcore Consulting Inc.
Impact
low
References

Bug 2068255
#CVE-2026-109776: Race condition in the XPCOM component

Reporter
Mozilla
Impact
low
References

Bug 2069395
#CVE-2026-109777: Information disclosure in the Storage: IndexedDB component

Reporter
Shu Takahashi of Velcore Consulting Inc.
Impact
low
References

Bug 2069638
#CVE-2026-109778: Privilege escalation in the WebExtensions component

Reporter
Mozilla
Impact
low
References

Bug 2070547
#CVE-2026-109781: Denial-of-service in the Printing: Output component

Reporter
Nguyen Thanh Nguyen
Impact
low
References

Bug 2072852


To generate a diff of this commit:
cvs rdiff -u -r1.8 -r1.9 pkgsrc/www/firefox153/Makefile
cvs rdiff -u -r1.4 -r1.5 pkgsrc/www/firefox153/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox153/Makefile
diff -u pkgsrc/www/firefox153/Makefile:1.8 pkgsrc/www/firefox153/Makefile:1.9
--- pkgsrc/www/firefox153/Makefile:1.8  Sun Oct 11 16:02:23 2026
+++ pkgsrc/www/firefox153/Makefile      Tue Oct 13 13:11:04 2026
@@ -1,12 +1,11 @@
-# $NetBSD: Makefile,v 1.8 2026/10/11 16:02:23 wiz Exp $
+# $NetBSD: Makefile,v 1.9 2026/10/13 13:11:04 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            153.4
+MOZ_BRANCH=            153.5
 MOZ_BRANCH_MINOR=      .0esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox153-/}
-PKGREVISION=   1
 CATEGORIES=    www
 MASTER_SITES+= ${MASTER_SITE_MOZILLA:=firefox/releases/${FIREFOX_VER}/source/}
 MASTER_SITES+= ${MASTER_SITE_MOZILLA_ALL:=firefox/releases/${FIREFOX_VER}/source/}

Index: pkgsrc/www/firefox153/distinfo
diff -u pkgsrc/www/firefox153/distinfo:1.4 pkgsrc/www/firefox153/distinfo:1.5
--- pkgsrc/www/firefox153/distinfo:1.4  Tue Sep 29 13:03:44 2026
+++ pkgsrc/www/firefox153/distinfo      Tue Oct 13 13:11:04 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.4 2026/09/29 13:03:44 gutteridge Exp $
+$NetBSD: distinfo,v 1.5 2026/10/13 13:11:04 gutteridge Exp $
 
-BLAKE2s (firefox-153.4.0esr.source.tar.xz) = 5cff0c4b06a94dcd63b0ef203d1e47b29c6399a0fe15e20dfc882eb0bb60bca8
-SHA512 (firefox-153.4.0esr.source.tar.xz) = 79e1f2a0f8c4d156c80b8f4c580aa944600d49cc811f961a3eca251113241638991fda94ccb74a44df9030f643586c41686861333288f13793e621a262a1b131
-Size (firefox-153.4.0esr.source.tar.xz) = 801731048 bytes
+BLAKE2s (firefox-153.5.0esr.source.tar.xz) = 9cd6556c9accb9f9cdbdfbcae1a934e7de4b5ae9394a93a5ceb8d545f8124a0a
+SHA512 (firefox-153.5.0esr.source.tar.xz) = 9acb8d1a4b241767e39da36d6f520d4edaae0f237f311496beeed10e2383cf399b0af11cac6984d425b620af0ecba3e67808637ec74733c7d23186d0dd2bd5d4
+Size (firefox-153.5.0esr.source.tar.xz) = 801858032 bytes
 BLAKE2s (nodejs-output-153.0.tgz) = 55a9ae8d1b743f57148a3b763bce2bc9afe2bd902f5b5d6a07a3e597c569aca1
 SHA512 (nodejs-output-153.0.tgz) = 2513c4c47c9bb619a1702a36b8ec316a6c48d6b641656abf86ff33c5ae9e146721947b26a3a1af8295a005daeffb0c77e5f82f36ca9a717decc6850b3518c275
 Size (nodejs-output-153.0.tgz) = 247910 bytes

Prev by Date: CVS commit: pkgsrc/lang/clang
Next by Date: CVS commit: pkgsrc/doc
Previous by Thread: CVS commit: pkgsrc/lang/clang
Next by Thread: CVS commit: pkgsrc/doc
Indexes:

Home | Main Index | Thread Index | Old Index