{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for firefox is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.\n\nSecurity Fix(es):\n\n* firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component (CVE-2026-74983)\n\n* firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component (CVE-2026-74934)\n\n* firefox: thunderbird: Privilege escalation in the Networking: Cookies component (CVE-2026-74953)\n\n* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74987)\n\n* firefox: thunderbird: Information disclosure in the Graphics component (CVE-2026-74948)\n\n* firefox: thunderbird: Use-after-free in the Graphics: ImageLib component (CVE-2026-74943)\n\n* firefox: thunderbird: Information disclosure in the DOM: UI Events \u0026 Focus Handling component (CVE-2026-74971)\n\n* firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component (CVE-2026-74941)\n\n* firefox: Privilege escalation in the Shell Integration component (CVE-2026-74965)\n\n* firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-74946)\n\n* firefox: Race condition, use-after-free in the Graphics component (CVE-2026-74973)\n\n* firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component (CVE-2026-74949)\n\n* firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (CVE-2026-74990)\n\n* firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-74936)\n\n* firefox: thunderbird: Use-after-free in the Graphics: Text component (CVE-2026-74940)\n\n* firefox: thunderbird: Site isolation issue in the WebExtensions component (CVE-2026-74960)\n\n* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-74969)\n\n* firefox: thunderbird: Mitigation bypass in the Storage: Cache API component (CVE-2026-74959)\n\n* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-74976)\n\n* firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component (CVE-2026-74974)\n\n* firefox: thunderbird: Mitigation bypass in the Safe Browsing component (CVE-2026-74957)\n\n* firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component (CVE-2026-74967)\n\n* firefox: Privilege escalation in the Remote Settings Client component (CVE-2026-74942)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-74939)\n\n* firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component (CVE-2026-74972)\n\n* firefox: thunderbird: Information disclosure in the Graphics: Text component (CVE-2026-74945)\n\n* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-74963)\n\n* firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component (CVE-2026-74944)\n\n* firefox: Integer overflow in the Graphics component (CVE-2026-74964)\n\n* firefox: Site isolation issue in the Networking: Cookies component (CVE-2026-74962)\n\n* firefox: thunderbird: Privilege escalation in the DOM: Networking component (CVE-2026-74935)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:58897",
        "url": "https://access.redhat.com/errata/RHSA-2026:58897"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2517819",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517819"
      },
      {
        "category": "external",
        "summary": "2517820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517820"
      },
      {
        "category": "external",
        "summary": "2517822",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517822"
      },
      {
        "category": "external",
        "summary": "2517823",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517823"
      },
      {
        "category": "external",
        "summary": "2517825",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517825"
      },
      {
        "category": "external",
        "summary": "2517826",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517826"
      },
      {
        "category": "external",
        "summary": "2517831",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517831"
      },
      {
        "category": "external",
        "summary": "2517833",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517833"
      },
      {
        "category": "external",
        "summary": "2517834",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517834"
      },
      {
        "category": "external",
        "summary": "2517835",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517835"
      },
      {
        "category": "external",
        "summary": "2517836",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517836"
      },
      {
        "category": "external",
        "summary": "2517837",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517837"
      },
      {
        "category": "external",
        "summary": "2517839",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517839"
      },
      {
        "category": "external",
        "summary": "2517840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517840"
      },
      {
        "category": "external",
        "summary": "2517841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517841"
      },
      {
        "category": "external",
        "summary": "2517845",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517845"
      },
      {
        "category": "external",
        "summary": "2517846",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517846"
      },
      {
        "category": "external",
        "summary": "2517849",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517849"
      },
      {
        "category": "external",
        "summary": "2517851",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517851"
      },
      {
        "category": "external",
        "summary": "2517853",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517853"
      },
      {
        "category": "external",
        "summary": "2517856",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517856"
      },
      {
        "category": "external",
        "summary": "2517858",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517858"
      },
      {
        "category": "external",
        "summary": "2517859",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517859"
      },
      {
        "category": "external",
        "summary": "2517860",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517860"
      },
      {
        "category": "external",
        "summary": "2517862",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517862"
      },
      {
        "category": "external",
        "summary": "2517863",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517863"
      },
      {
        "category": "external",
        "summary": "2517866",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517866"
      },
      {
        "category": "external",
        "summary": "2517868",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517868"
      },
      {
        "category": "external",
        "summary": "2517870",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517870"
      },
      {
        "category": "external",
        "summary": "2517872",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517872"
      },
      {
        "category": "external",
        "summary": "2517874",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517874"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58897.json"
      }
    ],
    "title": "Red Hat Security Advisory: firefox security update",
    "tracking": {
      "current_release_date": "2026-09-08T12:26:13+00:00",
      "generator": {
        "date": "2026-09-08T12:26:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:58897",
      "initial_release_date": "2026-08-24T10:24:17+00:00",
      "revision_history": [
        {
          "date": "2026-08-24T10:24:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-24T10:24:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-08T12:26:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream (v. 9)",
                  "product_id": "AppStream-9.8.0.Z.MAIN.EUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.14.0-1.el9_8.src",
                "product": {
                  "name": "firefox-0:140.14.0-1.el9_8.src",
                  "product_id": "firefox-0:140.14.0-1.el9_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.14.0-1.el9_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.14.0-1.el9_8.aarch64",
                "product": {
                  "name": "firefox-0:140.14.0-1.el9_8.aarch64",
                  "product_id": "firefox-0:140.14.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.14.0-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.14.0-1.el9_8.aarch64",
                "product": {
                  "name": "firefox-x11-0:140.14.0-1.el9_8.aarch64",
                  "product_id": "firefox-x11-0:140.14.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.14.0-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
                "product": {
                  "name": "firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
                  "product_id": "firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.14.0-1.el9_8?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
                "product": {
                  "name": "firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
                  "product_id": "firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.14.0-1.el9_8?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.14.0-1.el9_8.x86_64",
                "product": {
                  "name": "firefox-0:140.14.0-1.el9_8.x86_64",
                  "product_id": "firefox-0:140.14.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.14.0-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.14.0-1.el9_8.x86_64",
                "product": {
                  "name": "firefox-x11-0:140.14.0-1.el9_8.x86_64",
                  "product_id": "firefox-x11-0:140.14.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.14.0-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
                "product": {
                  "name": "firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
                  "product_id": "firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.14.0-1.el9_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
                "product": {
                  "name": "firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
                  "product_id": "firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.14.0-1.el9_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.14.0-1.el9_8.ppc64le",
                "product": {
                  "name": "firefox-0:140.14.0-1.el9_8.ppc64le",
                  "product_id": "firefox-0:140.14.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.14.0-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.14.0-1.el9_8.ppc64le",
                "product": {
                  "name": "firefox-x11-0:140.14.0-1.el9_8.ppc64le",
                  "product_id": "firefox-x11-0:140.14.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.14.0-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
                "product": {
                  "name": "firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
                  "product_id": "firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.14.0-1.el9_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
                "product": {
                  "name": "firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
                  "product_id": "firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.14.0-1.el9_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "firefox-0:140.14.0-1.el9_8.s390x",
                "product": {
                  "name": "firefox-0:140.14.0-1.el9_8.s390x",
                  "product_id": "firefox-0:140.14.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox@140.14.0-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-x11-0:140.14.0-1.el9_8.s390x",
                "product": {
                  "name": "firefox-x11-0:140.14.0-1.el9_8.s390x",
                  "product_id": "firefox-x11-0:140.14.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-x11@140.14.0-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debugsource-0:140.14.0-1.el9_8.s390x",
                "product": {
                  "name": "firefox-debugsource-0:140.14.0-1.el9_8.s390x",
                  "product_id": "firefox-debugsource-0:140.14.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debugsource@140.14.0-1.el9_8?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
                "product": {
                  "name": "firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
                  "product_id": "firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/firefox-debuginfo@140.14.0-1.el9_8?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.14.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64"
        },
        "product_reference": "firefox-0:140.14.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.14.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le"
        },
        "product_reference": "firefox-0:140.14.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.14.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x"
        },
        "product_reference": "firefox-0:140.14.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.14.0-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src"
        },
        "product_reference": "firefox-0:140.14.0-1.el9_8.src",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-0:140.14.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64"
        },
        "product_reference": "firefox-0:140.14.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.14.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64"
        },
        "product_reference": "firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le"
        },
        "product_reference": "firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.14.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x"
        },
        "product_reference": "firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debuginfo-0:140.14.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64"
        },
        "product_reference": "firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.14.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64"
        },
        "product_reference": "firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.14.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le"
        },
        "product_reference": "firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.14.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x"
        },
        "product_reference": "firefox-debugsource-0:140.14.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-debugsource-0:140.14.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64"
        },
        "product_reference": "firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.14.0-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64"
        },
        "product_reference": "firefox-x11-0:140.14.0-1.el9_8.aarch64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.14.0-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le"
        },
        "product_reference": "firefox-x11-0:140.14.0-1.el9_8.ppc64le",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.14.0-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x"
        },
        "product_reference": "firefox-x11-0:140.14.0-1.el9_8.s390x",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "firefox-x11-0:140.14.0-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
          "product_id": "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        },
        "product_reference": "firefox-x11-0:140.14.0-1.el9_8.x86_64",
        "relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74934",
      "cwe": {
        "id": "CWE-653",
        "name": "Improper Isolation or Compartmentalization"
      },
      "discovery_date": "2026-08-18T12:41:18.553257+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74934"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74934",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74934"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74934",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74934"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74934",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74934"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74934",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74934"
        }
      ],
      "release_date": "2026-08-18T12:23:27.344000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-74935",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-18T12:50:08.152782+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517874"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Networking component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Networking component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74935"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517874",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517874"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74935",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74935"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74935",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74935"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74935",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74935"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74935",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74935"
        }
      ],
      "release_date": "2026-08-18T12:23:27.630000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Networking component"
    },
    {
      "cve": "CVE-2026-74936",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:44:12.493679+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74936"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74936",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74936"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74936",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74936"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74936",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74936"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74936",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74936"
        }
      ],
      "release_date": "2026-08-18T12:23:27.882000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component"
    },
    {
      "cve": "CVE-2026-74939",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-18T12:47:41.333438+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517860"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the DOM: Navigation component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74939"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517860",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517860"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74939",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74939"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74939",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74939"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74939",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74939"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74939",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74939"
        }
      ],
      "release_date": "2026-08-18T12:23:28.208000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the DOM: Navigation component"
    },
    {
      "cve": "CVE-2026-74940",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:44:22.423095+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517841"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: Text component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: Text component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74940"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517841",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517841"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74940",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74940"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74940",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74940"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74940",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74940"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74940",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74940"
        }
      ],
      "release_date": "2026-08-18T12:23:28.488000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: Text component"
    },
    {
      "cve": "CVE-2026-74941",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-18T12:43:24.972764+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74941"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74941",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74941"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74941",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74941"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74941",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74941"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74941",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74941"
        }
      ],
      "release_date": "2026-08-18T12:23:28.747000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-74942",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-18T12:47:29.930927+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517859"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Remote Settings Client component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation in the Remote Settings Client component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74942"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517859",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517859"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74942",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74942"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74942",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74942"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74942",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74942"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74942",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74942"
        }
      ],
      "release_date": "2026-08-18T12:23:29.044000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: Privilege escalation in the Remote Settings Client component"
    },
    {
      "cve": "CVE-2026-74943",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:42:40.542639+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517826"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517826",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517826"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74943"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74943",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74943"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74943",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74943"
        }
      ],
      "release_date": "2026-08-18T12:23:29.309000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-74944",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:49:22.680083+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517868"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74944"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517868",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517868"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74944",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74944"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74944",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74944"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74944",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74944"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74944",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74944"
        }
      ],
      "release_date": "2026-08-18T12:23:29.582000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the DOM: Core \u0026 HTML component"
    },
    {
      "cve": "CVE-2026-74945",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-08-18T12:48:22.342907+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517863"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Graphics: Text component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Graphics: Text component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74945"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517863",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517863"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74945",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74945"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74945",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74945"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74945",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74945"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74945",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74945"
        }
      ],
      "release_date": "2026-08-18T12:23:29.811000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Graphics: Text component"
    },
    {
      "cve": "CVE-2026-74946",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-18T12:43:42.980734+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517835"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74946"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517835",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517835"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74946",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74946"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74946",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74946"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74946",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74946"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74946",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74946"
        }
      ],
      "release_date": "2026-08-18T12:23:30.090000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component"
    },
    {
      "cve": "CVE-2026-74948",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "discovery_date": "2026-08-18T12:42:04.113841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517825"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74948"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517825",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517825"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74948",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74948"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74948",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74948"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74948",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74948"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74948",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74948"
        }
      ],
      "release_date": "2026-08-18T12:23:30.321000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the Graphics component"
    },
    {
      "cve": "CVE-2026-74949",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-18T12:43:07.101263+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517837"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation due to use-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74949"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517837",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517837"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74949",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74949"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74949",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74949"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74949",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74949"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74949",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74949"
        }
      ],
      "release_date": "2026-08-18T12:23:30.578000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation due to use-after-free in the Graphics: Canvas2D component"
    },
    {
      "cve": "CVE-2026-74953",
      "cwe": {
        "id": "CWE-472",
        "name": "External Control of Assumed-Immutable Web Parameter"
      },
      "discovery_date": "2026-08-18T12:41:36.495351+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Networking: Cookies component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Privilege escalation in the Networking: Cookies component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74953"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74953",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74953"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74953",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74953"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74953",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74953"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74953",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74953"
        }
      ],
      "release_date": "2026-08-18T12:23:30.842000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Privilege escalation in the Networking: Cookies component"
    },
    {
      "cve": "CVE-2026-74957",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-08-18T12:47:04.723926+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Safe Browsing component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Safe Browsing component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74957"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74957",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74957"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74957",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74957"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74957",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74957"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74957",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74957"
        }
      ],
      "release_date": "2026-08-18T12:23:31.078000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Safe Browsing component"
    },
    {
      "cve": "CVE-2026-74959",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-08-18T12:46:06.700074+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517849"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Storage: Cache API component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Storage: Cache API component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74959"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517849",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517849"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74959",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74959"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74959",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74959"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74959",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74959"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74959",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74959"
        }
      ],
      "release_date": "2026-08-18T12:23:31.322000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Storage: Cache API component"
    },
    {
      "cve": "CVE-2026-74960",
      "cwe": {
        "id": "CWE-501",
        "name": "Trust Boundary Violation"
      },
      "discovery_date": "2026-08-18T12:45:17.340977+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517845"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the WebExtensions component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Site isolation issue in the WebExtensions component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74960"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517845",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517845"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74960",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74960"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74960",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74960"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74960",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74960"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74960",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74960"
        }
      ],
      "release_date": "2026-08-18T12:23:31.590000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Site isolation issue in the WebExtensions component"
    },
    {
      "cve": "CVE-2026-74962",
      "cwe": {
        "id": "CWE-1100",
        "name": "Insufficient Isolation of System-Dependent Functions"
      },
      "discovery_date": "2026-08-18T12:49:33.392848+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517872"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSite isolation issue in the Networking: Cookies component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Site isolation issue in the Networking: Cookies component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74962"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517872",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517872"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74962",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74962"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74962",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74962"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74962",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74962"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74962",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74962"
        }
      ],
      "release_date": "2026-08-18T12:23:31.860000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Site isolation issue in the Networking: Cookies component"
    },
    {
      "cve": "CVE-2026-74963",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-08-18T12:49:02.047728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517866"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Networking: Cookies component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74963"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517866",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517866"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74963",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74963"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74963",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74963"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74963",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74963"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74963",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74963"
        }
      ],
      "release_date": "2026-08-18T12:23:32.132000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component"
    },
    {
      "cve": "CVE-2026-74964",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-08-18T12:49:14.042814+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517870"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInteger overflow in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Integer overflow in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74964"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517870",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517870"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74964",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74964"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74964",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74964"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74964",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74964"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74964",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74964"
        }
      ],
      "release_date": "2026-08-18T12:23:32.369000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Integer overflow in the Graphics component"
    },
    {
      "cve": "CVE-2026-74965",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "discovery_date": "2026-08-18T12:43:33.483406+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517834"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nPrivilege escalation in the Shell Integration component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Privilege escalation in the Shell Integration component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74965"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517834",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517834"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74965",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74965"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74965",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74965"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74965",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74965"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74965",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74965"
        }
      ],
      "release_date": "2026-08-18T12:23:32.613000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Privilege escalation in the Shell Integration component"
    },
    {
      "cve": "CVE-2026-74967",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2026-08-18T12:47:21.242874+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517858"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Audio/Video: Playback component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74967"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517858",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517858"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74967",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74967"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74967",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74967"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74967",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74967"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74967",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74967"
        }
      ],
      "release_date": "2026-08-18T12:23:32.866000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component"
    },
    {
      "cve": "CVE-2026-74969",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:45:30.438913+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517846"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nUse-after-free in the Layout: Text and Fonts component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74969"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517846",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517846"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74969",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74969"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74969",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74969"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74969",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74969"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74969",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74969"
        }
      ],
      "release_date": "2026-08-18T12:23:33.155000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component"
    },
    {
      "cve": "CVE-2026-74971",
      "cwe": {
        "id": "CWE-360",
        "name": "Trust of System Event Data"
      },
      "discovery_date": "2026-08-18T12:42:32.337455+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517831"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the DOM: UI Events \u0026 Focus Handling component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the DOM: UI Events \u0026 Focus Handling component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74971"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517831",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517831"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74971",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74971"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74971",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74971"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74971",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74971"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74971",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74971"
        }
      ],
      "release_date": "2026-08-18T12:23:33.383000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the DOM: UI Events \u0026 Focus Handling component"
    },
    {
      "cve": "CVE-2026-74972",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-08-18T12:48:00.295910+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517862"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInformation disclosure in the DOM: Push Subscriptions component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74972"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517862",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517862"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74972",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74972"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74972",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74972"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74972",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74972"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74972",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74972"
        }
      ],
      "release_date": "2026-08-18T12:23:33.635000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Information disclosure in the DOM: Push Subscriptions component"
    },
    {
      "cve": "CVE-2026-74973",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-08-18T12:43:52.150968+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517836"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nRace condition, use-after-free in the Graphics component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: Race condition, use-after-free in the Graphics component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74973"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517836",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517836"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74973",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74973"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74973",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74973"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74973",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74973"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74973",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74973"
        }
      ],
      "release_date": "2026-08-18T12:23:33.845000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: Race condition, use-after-free in the Graphics component"
    },
    {
      "cve": "CVE-2026-74974",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-08-18T12:46:19.042707+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517853"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nSame-origin policy bypass in the Graphics: ImageLib component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74974"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517853",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517853"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74974",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74974"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74974",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74974"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74974",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74974"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74974",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74974"
        }
      ],
      "release_date": "2026-08-18T12:23:34.067000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component"
    },
    {
      "cve": "CVE-2026-74976",
      "cwe": {
        "id": "CWE-733",
        "name": "Compiler Optimization Removal or Modification of Security-critical Code"
      },
      "discovery_date": "2026-08-18T12:46:28.364431+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517851"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nJIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74976"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517851",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517851"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74976",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74976"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74976",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74976"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74976",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74976"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74976",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74976"
        }
      ],
      "release_date": "2026-08-18T12:23:34.327000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component"
    },
    {
      "cve": "CVE-2026-74983",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-08-18T12:41:07.307882+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517819"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nMitigation bypass in the Data Loss Prevention component",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74983"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517819",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517819"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74983",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74983"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74983",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74983"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74983",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74983"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74983",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74983"
        }
      ],
      "release_date": "2026-08-18T12:23:34.590000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.4,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "firefox: thunderbird: Mitigation bypass in the Data Loss Prevention component"
    },
    {
      "cve": "CVE-2026-74987",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-18T12:41:46.290292+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517823"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInternally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74987"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517823",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517823"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74987",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74987"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74987",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74987"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74987",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74987"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74987",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74987"
        }
      ],
      "release_date": "2026-08-18T12:23:34.847000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154"
    },
    {
      "cve": "CVE-2026-74990",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-18T12:44:32.073144+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue:\nInternally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
          "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74990"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74990",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74990"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74990",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74990"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74990",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-76/#CVE-2026-74990"
        },
        {
          "category": "external",
          "summary": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74990",
          "url": "https://www.mozilla.org/security/advisories/mfsa2026-79/#CVE-2026-74990"
        }
      ],
      "release_date": "2026-08-18T12:23:35.129000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-24T10:24:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:58897"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.src",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debuginfo-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-debugsource-0:140.14.0-1.el9_8.x86_64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.aarch64",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.ppc64le",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.s390x",
            "AppStream-9.8.0.Z.MAIN.EUS:firefox-x11-0:140.14.0-1.el9_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "firefox: thunderbird: Internally found bugs fixed in Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154"
    }
  ]
}