{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208)\n\n* firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719)\n\n* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718)\n\n* firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350)\n\n* firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391)\n\n* firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352)\n\n* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368)\n\n* firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377)\n\n* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360)\n\n* firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358)\n\n* firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387)\n\n* firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357)\n\n* firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379)\n\n* firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354)\n\n* firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374)\n\n* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359)\n\n* firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383)\n\n* firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369)\n\n* firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353)\n\n* firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396)\n\n* firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:47105",
        "url": "https://access.redhat.com/errata/RHSA-2026:47105"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2490799",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
      },
      {
        "category": "external",
        "summary": "2499973",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499973"
      },
      {
        "category": "external",
        "summary": "2499974",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499974"
      },
      {
        "category": "external",
        "summary": "2503415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503415"
      },
      {
        "category": "external",
        "summary": "2503416",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503416"
      },
      {
        "category": "external",
        "summary": "2503420",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503420"
      },
      {
        "category": "external",
        "summary": "2503423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503423"
      },
      {
        "category": "external",
        "summary": "2503425",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503425"
      },
      {
        "category": "external",
        "summary": "2503430",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503430"
      },
      {
        "category": "external",
        "summary": "2503432",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503432"
      },
      {
        "category": "external",
        "summary": "2503434",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503434"
      },
      {
        "category": "external",
        "summary": "2503439",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503439"
      },
      {
        "category": "external",
        "summary": "2503440",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503440"
      },
      {
        "category": "external",
        "summary": "2503444",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503444"
      },
      {
        "category": "external",
        "summary": "2503451",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503451"
      },
      {
        "category": "external",
        "summary": "2503454",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503454"
      },
      {
        "category": "external",
        "summary": "2503456",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503456"
      },
      {
        "category": "external",
        "summary": "2503463",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503463"
      },
      {
        "category": "external",
        "summary": "2503472",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503472"
      },
      {
        "category": "external",
        "summary": "2503473",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503473"
      },
      {
        "category": "external",
        "summary": "2503485",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503485"
      },
      {
        "category": "external",
        "summary": "2503489",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503489"
      },
      {
        "category": "external",
        "summary": "2503491",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503491"
      },
      {
        "category": "external",
        "summary": "2503497",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503497"
      },
      {
        "category": "external",
        "summary": "2503498",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503498"
      },
      {
        "category": "external",
        "summary": "2503500",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503500"
      },
      {
        "category": "external",
        "summary": "2503501",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503501"
      },
      {
        "category": "external",
        "summary": "2503505",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503505"
      },
      {
        "category": "external",
        "summary": "2503512",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503512"
      },
      {
        "category": "external",
        "summary": "2503513",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503513"
      },
      {
        "category": "external",
        "summary": "2503517",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503517"
      },
      {
        "category": "external",
        "summary": "2503521",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503521"
      },
      {
        "category": "external",
        "summary": "2503527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503527"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47105.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox security update",
    "tracking": {
      "current_release_date": "2026-07-29T04:24:58+00:00",
      "generator": {
        "date": "2026-07-29T04:24:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:47105",
      "initial_release_date": "2026-07-28T21:25:59+00:00",
      "revision_history": [
        {
          "date": "2026-07-28T21:25:59+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-28T21:25:59+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-29T04:24:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 8)",
                  "product_id": "AppStream-8.10.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.13.0-1.el8_10.src",
                "product": {
                  "name": "firefox-0:140.13.0-1.el8_10.src",
                  "product_id": "firefox-0:140.13.0-1.el8_10.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.13.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-0:140.13.0-1.el8_10.aarch64",
                  "product_id": "firefox-0:140.13.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
                  "product_id": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
                "product": {
                  "name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
                  "product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.13.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-0:140.13.0-1.el8_10.ppc64le",
                  "product_id": "firefox-0:140.13.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
                  "product_id": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
                "product": {
                  "name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
                  "product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.13.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-0:140.13.0-1.el8_10.x86_64",
                  "product_id": "firefox-0:140.13.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
                  "product_id": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
                  "product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.13.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-0:140.13.0-1.el8_10.s390x",
                  "product_id": "firefox-0:140.13.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.13.0-1.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
                  "product_id": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.13.0-1.el8_10?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
                  "product_id": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.13.0-1.el8_10?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-0:140.13.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-0:140.13.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-0:140.13.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.13.0-1.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src"
        },
        "product_reference": "firefox-0:140.13.0-1.el8_10.src",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-0:140.13.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64"
        },
        "product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le"
        },
        "product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.13.0-1.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x"
        },
        "product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.s390x",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)",
          "product_id": "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        },
        "product_reference": "firefox-debugsource-0:140.13.0-1.el8_10.x86_64",
        "relates_to_product_reference": "AppStream-8.10.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15718",
      "discovery_date": "2026-07-14T13:02:41.162425+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499974"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15718"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499974",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499974"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15718"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15718"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15718"
        }
      ],
      "release_date": "2026-07-14T12:15:46.176000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-15719",
      "cwe": {
        "id": "CWE-501",
        "name": "Trust Boundary Violation"
      },
      "discovery_date": "2026-07-14T13:02:22.676677+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499973"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nWe are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15719"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499973",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499973"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15719"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15719",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15719"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15719",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-15719"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15719",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-15719"
        }
      ],
      "release_date": "2026-07-14T12:15:47.592000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-16349",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-21T13:03:40.142033+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503485"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16349"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503485",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503485"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16349",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16349"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16349",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16349"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16349",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16349"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16349",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16349"
        }
      ],
      "release_date": "2026-07-21T12:37:31.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-16350",
      "discovery_date": "2026-07-21T13:01:11.415957+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503416"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: cubeb component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16350"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503416",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503416"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16350",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16350"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16350",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16350"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16350",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16350"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16350",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16350"
        }
      ],
      "release_date": "2026-07-21T12:37:32.759000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component"
    },
    {
      "cve": "CVE-2026-16351",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-21T13:03:55.355115+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503491"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16351"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503491",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503491"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16351",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16351"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16351",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16351"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16351",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16351"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16351",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16351"
        }
      ],
      "release_date": "2026-07-21T12:37:34.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-16352",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-07-21T13:02:10.079600+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503444"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16352"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503444",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503444"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16352",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16352"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16352",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16352"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16352",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16352"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16352",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16352"
        }
      ],
      "release_date": "2026-07-21T12:37:35.292000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component"
    },
    {
      "cve": "CVE-2026-16353",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-07-21T13:04:57.762278+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503517"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInvalid pointer in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16353"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503517",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503517"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16353",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16353"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16353",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16353"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16353",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16353"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16353",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16353"
        }
      ],
      "release_date": "2026-07-21T12:37:39.485000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component"
    },
    {
      "cve": "CVE-2026-16354",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-07-21T13:04:15.680875+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503500"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16354"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503500",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503500"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16354",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16354"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16354",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16354"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16354",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16354"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16354",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16354"
        }
      ],
      "release_date": "2026-07-21T12:37:40.337000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-16355",
      "discovery_date": "2026-07-21T13:02:01.136257+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16355"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16355"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16355"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16355"
        }
      ],
      "release_date": "2026-07-21T12:37:43.741000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-16356",
      "discovery_date": "2026-07-21T13:01:29.696265+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503425"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503425",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503425"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16356"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16356",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16356"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16356",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16356"
        }
      ],
      "release_date": "2026-07-21T12:37:44.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component"
    },
    {
      "cve": "CVE-2026-16357",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-21T13:03:51.750809+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503489"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16357"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503489",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503489"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16357",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16357"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16357",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16357"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16357",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16357"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16357",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16357"
        }
      ],
      "release_date": "2026-07-21T12:37:45.425000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Graphics component"
    },
    {
      "cve": "CVE-2026-16358",
      "cwe": {
        "id": "CWE-368",
        "name": "Context Switching Race Condition"
      },
      "discovery_date": "2026-07-21T13:03:11.591974+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503472"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Graphics: WebRender component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the Graphics: WebRender component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16358"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503472",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503472"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16358",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16358"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16358",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16358"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16358",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16358"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16358",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16358"
        }
      ],
      "release_date": "2026-07-21T12:37:54.669000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the Graphics: WebRender component"
    },
    {
      "cve": "CVE-2026-16359",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-07-21T13:04:29.562158+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the Audio/Video: GMP component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16359"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16359",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16359"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16359",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16359"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16359",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16359"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16359",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16359"
        }
      ],
      "release_date": "2026-07-21T12:38:07.338000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component"
    },
    {
      "cve": "CVE-2026-16360",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-07-21T13:02:39.804147+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503456"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16360"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503456",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503456"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16360",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16360"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16360",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16360"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16360"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16360"
        }
      ],
      "release_date": "2026-07-21T12:38:24.293000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153"
    },
    {
      "cve": "CVE-2026-16361",
      "discovery_date": "2026-07-21T13:02:04.174100+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16361"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16361",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16361"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16361",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16361"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16361",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16361"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16361",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16361"
        }
      ],
      "release_date": "2026-07-21T12:38:27.370000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13"
    },
    {
      "cve": "CVE-2026-16362",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-07-21T13:02:52.951321+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503463"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the WebRTC: Audio/Video component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16362"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503463",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503463"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16362",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16362"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16362",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16362"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16362",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16362"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16362",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16362"
        }
      ],
      "release_date": "2026-07-21T12:37:33.621000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component"
    },
    {
      "cve": "CVE-2026-16363",
      "cwe": {
        "id": "CWE-733",
        "name": "Compiler Optimization Removal or Modification of Security-critical Code"
      },
      "discovery_date": "2026-07-21T13:01:42.548758+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503430"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16363"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503430",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503430"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16363",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16363"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16363",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16363"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16363",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16363"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16363",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16363"
        }
      ],
      "release_date": "2026-07-21T12:37:36.171000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-16368",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-21T13:02:26.198789+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503451"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nIncorrect boundary conditions in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16368"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503451",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503451"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16368",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16368"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16368",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16368"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16368",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16368"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16368",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16368"
        }
      ],
      "release_date": "2026-07-21T12:37:41.992000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-16369",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-07-21T13:04:46.922091+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503513"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16369"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503513",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503513"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16369"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16369",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16369"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16369",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16369"
        }
      ],
      "release_date": "2026-07-21T12:37:42.865000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-16371",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-07-21T13:04:09.237706+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503497"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16371"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503497",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503497"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16371",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16371"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16371",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16371"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16371",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16371"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16371",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16371"
        }
      ],
      "release_date": "2026-07-21T12:37:47.142000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-16374",
      "cwe": {
        "id": "CWE-215",
        "name": "Insertion of Sensitive Information Into Debugging Code"
      },
      "discovery_date": "2026-07-21T13:04:20.487182+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503501"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Framework component in DevTools",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Framework component in DevTools",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16374"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503501",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503501"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16374",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16374"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16374",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16374"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16374",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16374"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16374",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16374"
        }
      ],
      "release_date": "2026-07-21T12:37:49.664000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Framework component in DevTools"
    },
    {
      "cve": "CVE-2026-16375",
      "discovery_date": "2026-07-21T13:01:26.390810+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Networking: HTTP component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the Networking: HTTP component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16375"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16375",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16375"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16375",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16375"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16375",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16375"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16375",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16375"
        }
      ],
      "release_date": "2026-07-21T12:37:50.458000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the Networking: HTTP component"
    },
    {
      "cve": "CVE-2026-16377",
      "discovery_date": "2026-07-21T13:02:33.453713+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503454"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the PDF Viewer component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the PDF Viewer component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16377"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503454",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503454"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16377",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16377"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16377",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16377"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16377",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16377"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16377",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16377"
        }
      ],
      "release_date": "2026-07-21T12:37:52.135000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the PDF Viewer component"
    },
    {
      "cve": "CVE-2026-16379",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-07-21T13:04:12.021375+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503498"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Content Processes component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Content Processes component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16379"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503498",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503498"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16379"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16379",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16379"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16379",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16379"
        }
      ],
      "release_date": "2026-07-21T12:37:53.832000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Content Processes component"
    },
    {
      "cve": "CVE-2026-16381",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-21T13:01:51.230556+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503434"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Networking: DNS component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16381"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503434",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503434"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16381",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16381"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16381",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16381"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16381",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16381"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16381",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16381"
        }
      ],
      "release_date": "2026-07-21T12:37:56.371000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component"
    },
    {
      "cve": "CVE-2026-16383",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-21T13:04:43.253585+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503512"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the DOM: Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the DOM: Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16383"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503512",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503512"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16383",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16383"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16383",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16383"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16383",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16383"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16383",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16383"
        }
      ],
      "release_date": "2026-07-21T12:37:58.017000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the DOM: Networking component"
    },
    {
      "cve": "CVE-2026-16387",
      "cwe": {
        "id": "CWE-501",
        "name": "Trust Boundary Violation"
      },
      "discovery_date": "2026-07-21T13:03:15.259855+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503473"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16387"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503473",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503473"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16387",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16387"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16387",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16387"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16387",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16387"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16387",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16387"
        }
      ],
      "release_date": "2026-07-21T12:38:01.478000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the Networking component"
    },
    {
      "cve": "CVE-2026-16390",
      "discovery_date": "2026-07-21T13:01:08.261586+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Enterprise Policies component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Enterprise Policies component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16390"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503415",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503415"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16390",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16390"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16390",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16390"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16390",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16390"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16390",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16390"
        }
      ],
      "release_date": "2026-07-21T12:38:04.009000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Enterprise Policies component"
    },
    {
      "cve": "CVE-2026-16391",
      "discovery_date": "2026-07-21T13:01:20.641285+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503420"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Storage: IndexedDB component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Storage: IndexedDB component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16391"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503420",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503420"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16391"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16391",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16391"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16391",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16391"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16391",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16391"
        }
      ],
      "release_date": "2026-07-21T12:38:04.805000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Storage: IndexedDB component"
    },
    {
      "cve": "CVE-2026-16396",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-07-21T13:05:05.443790+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503521"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in WebExtensions",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in WebExtensions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16396"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503521",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503521"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16396",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16396"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16396",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16396"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16396",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16396"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16396",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16396"
        }
      ],
      "release_date": "2026-07-21T12:38:09.831000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in WebExtensions"
    },
    {
      "cve": "CVE-2026-16405",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-07-21T13:05:21.848352+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Networking: WebSockets component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Networking: WebSockets component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16405"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16405",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16405"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16405",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16405"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16405",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16405"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16405",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16405"
        }
      ],
      "release_date": "2026-07-21T12:38:17.436000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Networking: WebSockets component"
    },
    {
      "cve": "CVE-2026-16412",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-07-21T13:01:45.846131+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503432"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMemory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16412"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503432",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503432"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16412",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16412"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16412",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16412"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16412",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-70/#CVE-2026-16412"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16412",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-72/#CVE-2026-16412"
        }
      ],
      "release_date": "2026-07-21T12:38:23.323000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "The FuzzAnything Team"
          ],
          "organization": "FuzzAnything"
        }
      ],
      "cve": "CVE-2026-56208",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "discovery_date": "2026-06-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490799"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw in the AV1 encoder\u0027s Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a denial of service (process crash) or potentially achieve code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important severity because a heap buffer overflow with attacker-influenced data can cause reliable denial of service and potentially lead to code execution, though the attacker has only indirect control over the written values (encoder-computed statistics). In Red Hat products, libaom ships bundled within Firefox and Thunderbird as a statically-linked dependency used for AV1 decoding and WebRTC encoding. The vulnerable code path requires the encoder to be configured with g_lag_in_frames \u003e= 1 (Look-Ahead Processing mode). In Firefox\u0027s WebRTC implementation, the encoder configuration is controlled by the browser itself and not exposed to remote peers, which significantly limits the attack surface compared to standalone transcoding services. RHEL-AI 3.4 and Hummingbird 1 ship standalone libaom (aom) packages at versions within the affected range. Applications on those platforms that use the libaom encoder API with LAP mode and accept untrusted configuration input are vulnerable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
          "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56208"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490799",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490799"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56208",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56208"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56208"
        },
        {
          "category": "external",
          "summary": "https://aomedia.googlesource.com/aom/+/243f8ae84b",
          "url": "https://aomedia.googlesource.com/aom/+/243f8ae84b"
        },
        {
          "category": "external",
          "summary": "https://issues.chromium.org/issues/504317456",
          "url": "https://issues.chromium.org/issues/504317456"
        }
      ],
      "release_date": "2026-06-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-28T21:25:59+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47105"
        },
        {
          "category": "workaround",
          "details": "There is no complete mitigation for this vulnerability. The following measures can reduce risk:\n\n1. If using libaom as a standalone encoder library, avoid setting g_lag_in_frames to values \u003e= 1 when processing untrusted input, or validate all encoder configuration parameters before passing them to the libaom API.\n2. For Firefox and Thunderbird, ensure browsers are updated to versions that include the patched libaom (v3.14.0 or later).\n3. For standalone libaom deployments (RHEL-AI, Hummingbird), restrict access to the encoding service to trusted clients only.\n4. Apply network-level access controls to limit who can submit video for encoding.",
          "product_ids": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.src",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debuginfo-0:140.13.0-1.el8_10.x86_64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.aarch64",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.ppc64le",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.s390x",
            "AppStream-8.10.0.Z.MAIN.EUS:firefox-debugsource-0:140.13.0-1.el8_10.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode"
    }
  ]
}