CVS commit: pkgsrc/www/firefox140

["David H. Gutteridge" <gutteridge%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   gutteridge
Date:           Tue Sep  1 16:02:34 UTC 2026

Modified Files:
        pkgsrc/www/firefox140: Makefile distinfo

Log Message:
firefox140: update to 140.15

Mozilla Foundation Security Advisory 2026-84
Security Vulnerabilities fixed in Firefox ESR 140.15

Announced
    September 1, 2026
Impact
    high
Products
    Firefox ESR
Fixed in

        Firefox ESR 140.15

#CVE-2026-75874: Sandbox escape in the Remote Settings Client component

Reporter
    crixer
Impact
    high

References

    Bug 2039972

#CVE-2026-16365: Privilege escalation in the DOM: Workers component

Reporter
    Khanh Nguyen
Impact
    high

References

    Bug 2049149

#CVE-2026-84119: Sandbox escape due to use-after-free in the DOM: Navigation component

Reporter
    Yaqoub Aldurayhim
Impact
    high

References

    Bug 2057817

#CVE-2026-84120: Use-after-free in the Audio/Video component

Reporter
    Ukyo Akai
Impact
    high

References

    Bug 2058911

#CVE-2026-84121: Sandbox escape due to use-after-free in the DOM: Security component

Reporter
    Yaqoub Aldurayhim
Impact
    high

References

    Bug 2059018

#CVE-2026-84122: Use-after-free in the Audio/Video component

Reporter
    Hyeonjun Ahn
Impact
    high

References

    Bug 2059965

#CVE-2026-84124: Use-after-free in the DOM: Core & HTML component

Reporter
    Hyeonjun Ahn
Impact
    high

References

    Bug 2061110

#CVE-2026-16371: Privilege escalation in the DOM: Navigation component

Reporter
    Steven Julian
Impact
    moderate

References

    Bug 2008369

#CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component

Reporter
    navapon
Impact
    moderate

References

    Bug 2060008

#CVE-2026-84143: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

Reporter
    Jan de Mooij, Tom Ritter and the Mozilla Fuzzing Team
Impact
    high

Description

Internally found bugs present in Firefox 154, Firefox ESR 153.1 and Firefox ESR 140.14. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that 
with enough effort some of these could have been exploited.
References

    High Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
    Moderate Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
    Low Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15

#CVE-2026-84145: Internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40

Reporter
    Leo Tenenbaum, Tom Ritter and the Mozilla Fuzzing Team
Impact
    high

Description

Internally found bugs present in Firefox 154, Firefox ESR 153.1, Firefox ESR 140.14 and Firefox ESR 115.39. Some of these bugs showed evidence of memory corruption or another security-relevant defect 
and we presume that with enough effort some of these could have been exploited.
References

    High Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40
    Moderate Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40
    Low Severity internally found bugs fixed in Firefox 155, Firefox ESR 153.2, Firefox ESR 140.15 and Firefox ESR 115.40


To generate a diff of this commit:
cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/firefox140/Makefile
cvs rdiff -u -r1.20 -r1.21 pkgsrc/www/firefox140/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/firefox140/Makefile
diff -u pkgsrc/www/firefox140/Makefile:1.22 pkgsrc/www/firefox140/Makefile:1.23
--- pkgsrc/www/firefox140/Makefile:1.22 Wed Aug 19 02:36:12 2026
+++ pkgsrc/www/firefox140/Makefile      Tue Sep  1 16:02:34 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.22 2026/08/19 02:36:12 gutteridge Exp $
+# $NetBSD: Makefile,v 1.23 2026/09/01 16:02:34 gutteridge Exp $
 
 FIREFOX_VER=           ${MOZ_BRANCH}${MOZ_BRANCH_MINOR}
-MOZ_BRANCH=            140.14
+MOZ_BRANCH=            140.15
 MOZ_BRANCH_MINOR=      .0esr
 
 DISTNAME=      firefox-${FIREFOX_VER}.source

Index: pkgsrc/www/firefox140/distinfo
diff -u pkgsrc/www/firefox140/distinfo:1.20 pkgsrc/www/firefox140/distinfo:1.21
--- pkgsrc/www/firefox140/distinfo:1.20 Wed Aug 19 02:36:12 2026
+++ pkgsrc/www/firefox140/distinfo      Tue Sep  1 16:02:34 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.20 2026/08/19 02:36:12 gutteridge Exp $
+$NetBSD: distinfo,v 1.21 2026/09/01 16:02:34 gutteridge Exp $
 
-BLAKE2s (firefox-140.14.0esr.source.tar.xz) = 6e444488cfb0cd6c0ec8dbcc7328916fcf2b9ef09ec327886a7116cd3a7c54cb
-SHA512 (firefox-140.14.0esr.source.tar.xz) = 0609cca9bfaecbff56cdf13458534bd8cfa43f139056867d3b6394a767281599ee600f83165ad25565ced59b552592aa84431357458ccecfbe5bf104dca501c7
-Size (firefox-140.14.0esr.source.tar.xz) = 643083928 bytes
+BLAKE2s (firefox-140.15.0esr.source.tar.xz) = 6a82557345fb1b797bea278dd84fda29fcb4c19be1f579c08b082a3b3b191b78
+SHA512 (firefox-140.15.0esr.source.tar.xz) = c3a9c92776fc0fe4ec84e83d608822a84ab424bef3e9200de8e17f161369d13bb4a5caf5de326dded23edaf1c6b424d831218029786d4cfd1d857ee2634efeff
+Size (firefox-140.15.0esr.source.tar.xz) = 640054332 bytes
 BLAKE2s (nodejs-output-140.0.4.tgz) = 7ebb5993c8c9d7d5492afdb9fa7fef74fec7753fb0b14673817f24faf4a7fca4
 SHA512 (nodejs-output-140.0.4.tgz) = e421b0b6be8b5b8dfda705eefcf4573a1270df9012dca5eac9ba0ac2af2bcc47dd66b1057106f8c2336a10bdcc39b9f852041dd33da9e7a8929d981dbb4e1fb4
 Size (nodejs-output-140.0.4.tgz) = 245385 bytes