CVS commit: pkgsrc/www/firefox140

["David H. Gutteridge" <gutteridge%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Thu May  7 20:25:32 UTC 2026

Modified Files:
        pkgsrc/www/firefox140: Makefile distinfo

Log Message:
firefox140: update to 140.10.2

Mozilla Foundation Security Advisory 2026-41
Security Vulnerabilities fixed in Firefox ESR 140.10.2

Announced
    May 7, 2026
Impact
    high
Products
    Firefox ESR
Fixed in

        Firefox ESR 140.10.2

#CVE-2026-8090: Use-after-free in the DOM: Networking component

Reporter
    Kevin Brosnan
Impact
    high

References

    Bug 2034352

#CVE-2026-8094: Other issue in the WebRTC component

Reporter
    Michael Froman
Impact
    high

References

    Bug 2035939

#CVE-2026-8092: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2

Reporter
    Andrew McCreight, Christian Holler, Lee Salzman, Maurice Dauer, Tom Schuster, Wayne Mery and the Mozilla Fuzzing Team
Impact
    high

Description

Memory safety bugs present in Firefox ESR 115.35.1, Firefox ESR 140.10.1 and Firefox 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of 
these could have been exploited to run arbitrary code.
References

    Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2


To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 pkgsrc/www/firefox140/Makefile \
    pkgsrc/www/firefox140/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox140/Makefile
diff -u pkgsrc/www/firefox140/Makefile:1.15 pkgsrc/www/firefox140/Makefile:1.16
--- pkgsrc/www/firefox140/Makefile:1.15 Thu Apr 30 18:51:22 2026
+++ pkgsrc/www/firefox140/Makefile      Thu May  7 20:25:32 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.15 2026/04/30 18:51:22 gutteridge Exp $
+# $NetBSD: Makefile,v 1.16 2026/05/07 20:25:32 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
 MOZ_BRANCH=            140.10
-MOZ_BRANCH_MINOR=      .1esr
+MOZ_BRANCH_MINOR=      .2esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source
 PKGNAME=       ${DISTNAME:S/.source//:S/b/beta/:S/esr//:S/firefox-/firefox140-/}
Index: pkgsrc/www/firefox140/distinfo
diff -u pkgsrc/www/firefox140/distinfo:1.15 pkgsrc/www/firefox140/distinfo:1.16
--- pkgsrc/www/firefox140/distinfo:1.15 Thu Apr 30 21:47:25 2026
+++ pkgsrc/www/firefox140/distinfo      Thu May  7 20:25:32 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.15 2026/04/30 21:47:25 gutteridge Exp $
+$NetBSD: distinfo,v 1.16 2026/05/07 20:25:32 gutteridge Exp $
 
-BLAKE2s (firefox-140.10.1esr.source.tar.xz) = c1ff3f87a5fe9357dafc87c008d6b2ada6dab049808e9be258f6dda37d44222a
-SHA512 (firefox-140.10.1esr.source.tar.xz) = aa3481dbdda0a302acefff52007ba2e6927962523408b942a7df673e80618fc381faf1ca70ebaac3760645bf7cb382b85658af49beca705cd636ce9de58349a5
-Size (firefox-140.10.1esr.source.tar.xz) = 638929340 bytes
+BLAKE2s (firefox-140.10.2esr.source.tar.xz) = e8ccac19f20030271519ca34b325ee152f6f53f8343bea5b4c1cf1359a63aa4c
+SHA512 (firefox-140.10.2esr.source.tar.xz) = bda7d5e6d59a2ad310e3f3e6e8ec05c78222edce266671d5d454dfa3e8f0086add3b9c0099db907cb62b2587ed47026ba7b3aa4f0406693d142d8d91b818d551
+Size (firefox-140.10.2esr.source.tar.xz) = 638783848 bytes
 BLAKE2s (nodejs-output-140.0.4.tgz) = 7ebb5993c8c9d7d5492afdb9fa7fef74fec7753fb0b14673817f24faf4a7fca4
 SHA512 (nodejs-output-140.0.4.tgz) = e421b0b6be8b5b8dfda705eefcf4573a1270df9012dca5eac9ba0ac2af2bcc47dd66b1057106f8c2336a10bdcc39b9f852041dd33da9e7a8929d981dbb4e1fb4
 Size (nodejs-output-140.0.4.tgz) = 245385 bytes