Critical DSA-5097-1 5 CVEs

firefox-esr - security update

Published Mar 9, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 10	firefox-esr	91.7.0esr-1~deb10u1
Debian · 11	firefox-esr	91.7.0esr-1~deb11u1

Vulnerabilities 5

Critical 9.6

CVE-2022-26384

If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-26381

An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 7.5

CVE-2022-26387

When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 6.5

CVE-2022-26386

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…

Mozilla Thunderbird Firefox ESR thunderbird Browsers Debian Ubuntu Alpine

Dec 22, 2022
Medium 4.3

CVE-2022-26383

When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022