Summary
[128.10.1-1.0.1]
- Update to 128.10.1 [Orabug: 38028280][CVE-2025-4918][CVE-2025-4919]
[128.10.0-1.0.1]
- Updated to 128.10.0 build [Orabug: 37924620]
- Fixes CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 and
- CVE-2025-4093
[128.9.0-2.0.1]
- Update to 128.9.0 build2 [Orabug: 37796786][CVE-2025-3028][CVE-2025-3029]
[CVE-2025-3030]
[128.8.0-1.0.1]
- Update to 128.8.0 build1 [Orabug: 37700882][CVE-2025-1930][CVE-2025-1931]
[CVE-2025-1932][CVE-2025-1933][CVE-2025-1934][CVE-2025-1935][CVE-2025-1936]
[CVE-2025-1937][CVE-2025-1938]
[128.7.0-1.0.1]
- Update to 128.7.0 build1 [Orabug: 37564202][CVE-2025-1009][CVE-2025-1010]
[CVE-2025-1011][CVE-2025-1012][CVE-2025-1013][CVE-2025-1014][CVE-2025-1016]
[CVE-2025-1017]
[128.6.0-1.0.1]
- Update to 128.6.0 build1 [Orabug: 37460830][CVE-2025-0237][CVE-2025-0238]
[CVE-2025-0239][CVE-2025-0240][CVE-2025-0241][CVE-2025-0242][CVE-2025-0243]
- Enable PipeWire camera support for RHEL 10
+ backport upstream fixes for PipeWire camera support
Fixes: RHEL-64749
[128.5.1-1.0.1]
- Update to 128.5.1 [Orabug: 37370369][CVE-2024-11692][CVE-2024-11694]
[CVE-2024-11695][CVE-2024-11696][CVE-2024-11697][CVE-2024-11699]
[128.4.0-1.0.1]
- Update to 128.4.0 build1 [Orabug: 37236498][CVE-2024-10458][CVE-2024-10459]
[CVE-2024-10460][CVE-2024-10461][CVE-2024-10462][CVE-2024-10463]
[CVE-2024-10464][CVE-2024-10465][CVE-2024-10466][CVE-2024-10467]
[128.3.1-2.0.1]
- Update to 128.3.1 [Orabug: 37168934]
[128.3.0-1.0.1]
- Update to 128.3.0 [Orabug: 37139909]
[128.2.0-1.0.1]
- Remove nomerge annotation from abort calls [Orabug: 37079143]
- Update to 128.2.0 [Orabug: 37079143]
[115.12.0-1.0.3]
- Security fixes [Orabug: 36904311][Orabug: 36948200][CVE-2024-6601]
[CVE-2024-6603][CVE-2024-6604][CVE-2024-7519][CVE-2024-7520][CVE-2024-7521]
[CVE-2024-7522][CVE-2024-7524][CVE-2024-7525][CVE-2024-7526][CVE-2024-7527]
[CVE-2024-7529]
[115.12.0-1.0.1]
- Remove upstream references [Orabug: 30143292]
- Update distribution for Oracle Linux [Orabug: 30143292]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file
[115.12.0-1]
- Update to 115.12.0 build1
[115.11.0-1]
- Update to 115.11.0 build1
[115.10.0-1]
- Update to 115.10.0 build1
[115.9.1-2]
- Removed expat CVE fix
[115.9.1-1]
- Update to 115.9.1
[115.9.0-2]
- Update to 115.9.0 build2
[115.9.0-1]
- Update to 115.9.0 build1
- Fix expat CVE-2023-52425
[115.8.0-1]
- Update to 115.8.0 build1
[115.7.0-1]
- Update to 115.7.0 build1
[115.6.0-1]
- Update to 115.6.0 build1
[115.5.0-1]
- Update to 115.5.0 build1
[115.4.0-1]
- Update to 115.4.0 build1
- Add fix for CVE-2023-44488
- Set homepage from os-release HOME_URL
[115.3.1-1]
- Update to 115.3.1
[115.3.0-1]
- Update to 115.3.0 ESR
[115.2.0-3]
- Update to 115.2.0 ESR
[115.1.0-1]
- Update to 115.1.0 ESR
[115.0.2-1]
- Update to 115.0.2 ESR
[115.0b8-1]
- Update to 115.0b8
[102.11.0-2]
- Update to 102.11.0 build2
[102.11.0-1]
- Update to 102.11.0 build1
[102.10.0-1]
- Update to 102.10.0 build1
[102.9.0-4]
- Update to 102.9.0 build2
[102.9.0-2]
- removed disable-openh264-download
[102.9.0-1]
- Update to 102.9.0 build1
[102.8.0-2]
- Update to 102.8.0 build2
[102.8.0-1]
- Update to 102.8.0 build1
[102.7.0-1]
- Update to 102.7.0 build1
[102.6.0-2]
- Add firefox-x11 subpackage to allow explicit run of firefox under x11 on RHEL9
[102.6.0-1]
- Update to 102.6.0 build1
[102.5.0-2]
- Added libwebrtc screencast patch for newer features
[102.5.0-1]
- Update to 102.5.0 build1
[102.4.0-1]
- Update to 102.4.0 build1
[102.3.0-7]
- Fix for expat CVE-2022-40674 and non functional webrtc
[102.3.0-6]
- Update to 102.3.0 build1
[91.12.0-1]
- Update to 91.12.0 build1
[91.11.0-2]
- Update to 91.11.0 build2
[91.11.0-1]
- Update to 91.11.0 build1
[91.10.0-1]
- Update to 91.10.0 build1
[91.9.1-1]
- Update to 91.9.1 build1
[91.9.0-1]
- Update to 91.9.0
[91.8.0-1]
- Update to 91.8.0
[91.7.0-3]
- Update to 91.7.0 build3
[91.7.0-2]
- Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315
[91.7.0-1]
- Update to 91.7.0 build2
[91.6.0-2]
- Install langpacks to the browser/extensions to make them available in UI:
rhbz#2030190
[91.6.0-1]
- Update to 91.6.0 build1
[91.5.0-2]
- Use default update channel to fix non working enterprise policies:
rhbz#2044667
[91.5.0-1]
- Update to 91.5.0 build1
[91.4.0-2]
- Added fix for failing addons signatures.
[91.4.0-1]
- Update to 91.4.0 build1
[91.3.0-1]
- Update to 91.3.0 build1
[91.2.0-5]
- Fixed crashes when FIPS is enabled.
[91.2.0-4]
- Disable webrender on the s390x due to wrong colors: rhbz#2009503
[91.2.0-3]
- Update to 91.2.0 build1
[91.1.0-1]
- Update to 91.1.0 build1
* Tue Aug 17 2021 Jan Horak <jhorak@redhat.com>
- Update to 91.0.1 build1
[91.0-1]
- Update to 91.0 ESR
[91.0-1]
- Update to 91.0b8
[78.12.0-2]
- Rebuild to pickup older nss
[78.12.0-1]
- Update to 78.12.0 build1
[78.11.0-3]
- Update to 78.11.0 build2 (release)
[78.11.0-2]
- Fix rhel_minor_version for dist .el8_4 and .el8
[78.11.0-1]
- Update to 78.11.0 build1
[78.10.0-1]
- Update to 78.10.0
[78.9.0-1]
- Update to 78.9.0 build1
[78.8.0-1]
- Update to 78.8.0 build2
[78.7.1-1]
- Update to 78.7.1
[78.7.0-3]
- Fixing install prefix for the homepage
[78.7.0-2]
- Update to 78.7.0 build2
[78.7.0-1]
- Update to 78.7.0 build1
[78.6.1-1]
- Update to 78.6.1 build1
[78.6.0-1]
- Update to 78.6.0 build1
[78.5.0-1]
- Update to 78.5.0 build1
* Tue Nov 10 2020 erack@redhat.com - 78.4.1-1
- Update to 78.4.1
[78.4.0-3]
- Fixing flatpak build, fixing firefox.sh.in to not disable langpacks loading
[78.4.0-2]
- Enable addon sideloading
[78.4.0-1]
- Update to 78.4.0 build2
* Fri Sep 18 2020 Jan Horak <jhorak@redhat.com>
- Update to 78.3.0 build1
[78.2.0-3]
- Update to 78.2.0 build1
* Fri Jul 24 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.11.0 build1
* Fri Jun 26 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.10.0 build1
* Fri May 29 2020 Jan Horak <jhorak@redhat.com>
- Update to 68
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | firefox | 0:128.10.1-1.0.1.el7_9 |
Vulnerabilities 2
-
Critical 9.8
Out-of-bounds access when resolving Promise objects
An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.
-
High 8.8
Out-of-bounds access when optimizing linear sums
An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.