Skip to content
OpenAdvisories
Medium · 5.4 CVE-2026-113470 EUVD-2026-104991GHSA-vr39-qqr3-x9v4

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Published Oct 20, 2026 · Updated Nov 10, 2026 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Thunderbird Package: firefox-esr Package: mozjs102 Package: mozjs115 Package: mozjs38 Package: mozjs52 Package: mozjs68 Package: mozjs78 Package: mozjs91 Package: thunderbird Package: thunderbird Category: Browsers Ecosystem: Debian Ecosystem: Ubuntu

Description

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.

Affected products

VendorProductAffectedFixed
Mozilla Firefox — 115.43.1
Mozilla Thunderbird — 153.5.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 firefox-esr 153.5.1esr-1 —
Debian 14 thunderbird No fix yet —
Debian 13 firefox-esr 153.5.1esr-1~deb13u1 —
Debian 13 thunderbird 1:153.5.1esr-1~deb13u1 —
Debian 12 firefox-esr 153.5.1esr-1~deb12u1 —
Debian 12 thunderbird 1:153.5.1esr-1~deb12u1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS mozjs102 +1 No fix yet —
Ubuntu 22.04 LTS mozjs78 +3 No fix yet —
Ubuntu 20.04 LTS mozjs52 +1 No fix yet —
Ubuntu 18.04 LTS mozjs38 +1 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES 15 SP6 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES 15 SP5 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES 15 SP4 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES 12 SP5 MozillaFirefox 153.6.0-118.19.2 SUSE-SU-2026:4928-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES for SAP 15 SP5 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLES for SAP 15 SP4 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLE Micro 6.2 mozilla-nss 3.125-160000.3.1 SUSE-SU-2026:24412-1
SLE HPC 15 SP5 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1
SLE HPC 15 SP4 MozillaFirefox 153.6.0-150400.157.19.1 SUSE-SU-2026:5145-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 158.0.1-1.1 openSUSE-SU-2026:12259-1
openSUSE Tumbleweed firefox-esr +1 153.5.1-1.1 openSUSE-SU-2026:12224-1, openSUSE-SU-2026:12211-1
openSUSE Leap 16.0 MozillaFirefox 153.5.1-160000.1.1 openSUSE-SU-2026:22159-1
openSUSE Leap 16.0 mozilla-nss 3.125-160000.3.1 openSUSE-SU-2026:22159-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 awscli-2 2.36.47-4.amzn2023.0.1 ALAS2023-2026-3133
Amazon Linux 2023 ca-certificates 2025.2.76-1.0.amzn2023.0.4 ALAS2023-2026-3306
Amazon Linux 2023 firefox 153.5.1-1.amzn2023.0.1 ALAS2023-2026-3329
Amazon Linux 2023 java-1.8.0-amazon-corretto +2 1:1.8.0_512.b08-1.amzn2023 ALAS2023-2026-3315
Amazon Linux 2023 java-11-amazon-corretto +5 1:11.0.33.0.9-1.amzn2023 ALAS2023-2026-3317
Amazon Linux 2023 java-17-amazon-corretto +5 1:17.0.21.0.10-1.amzn2023.1 ALAS2023-2026-3318
Amazon Linux 2023 java-21-amazon-corretto +5 1:21.0.13.0.10-1.amzn2023.1 ALAS2023-2026-3319
Amazon Linux 2023 java-25-amazon-corretto +5 1:25.0.5.0.9-1.amzn2023.1 ALAS2023-2026-3320
Amazon Linux 2023 java-27-amazon-corretto +5 1:27.0.1.0.10-1.amzn2023.1 ALAS2023-2026-3316
Amazon Linux 2 ca-certificates 2025.2.76-1.amzn2.0.3 ALAS2-2026-4037
Amazon Linux 2 java-11-amazon-corretto +3 1:11.0.33.0.9-1.amzn2 ALAS2-2026-4039
Amazon Linux 2 java-17-amazon-corretto +5 1:17.0.21.0.10-1.amzn2.1 ALAS2-2026-4040
Amazon Linux 2 python2-botocore 1.12.92-2.amzn2.0.1 ALAS2-2026-4116

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 ca-certificates 2025.2.80_v9.0.305-102.0.1.el10_2 ELSA-2026-500451
Oracle Linux 9 ca-certificates 2025.2.80_v9.0.305-91.0.1.el9 ELSA-2026-500450
Oracle Linux 8 ca-certificates 2025.2.80_v9.0.304-80.2.0.1.el8_10 ELSA-2026-500449
Oracle Linux 7 ca-certificates 2025.2.80_v9.0.304-71.0.2.el7_9 ELSA-2026-500496

Advisories 26

References