/
← Voltar ao feed
high

CERT-FR: Multiple Mozilla Firefox, Firefox ESR and Thunderbird vulnerabilities allow arbitrary code execution and data disclosure

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 1 dia

CERT-FR advisory CERTFR-2026-AVI-1346 reports multiple vulnerabilities in Mozilla products (Firefox, Firefox ESR and Thunderbird), fixed in Mozilla security bulletins mfsa2026-111 to mfsa2026-115 of 20 October 2026. According to the advisory, some of the flaws allow an attacker to achieve arbitrary code execution, breach of data confidentiality and denial of service. The advisory does not mention active exploitation, IOCs or attribution, and the vendor did not specify a security-bypass impact.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1346 covers eight CVEs (CVE-2026-113399, 113400, 113401, 113470, 113866, 113867, 113868, 113869) in Mozilla Firefox, Firefox ESR and Thunderbird. It says some of them allow arbitrary code execution, breach of data confidentiality and denial of service. It does not map impacts to individual CVEs, so no single CVE can be called the most severe. It gives no CVSS scores, attack vectors or prerequisites. Affected: Firefox before 158.0.1, Firefox ESR before 115.43.1 and before 153.5.1, Thunderbird before 153.5.1 and before 158.0.1. Fixed in those versions or later, per Mozilla bulletins mfsa2026-111 to mfsa2026-115 of 20 October 2026.

Como funciona

The sources do not describe how any of these flaws work. The advisory only lists the possible outcomes (code execution, confidentiality breach, denial of service) and refers readers to the Mozilla bulletins for details. The affected component, the input that reaches it and the step where it fails are not stated, so no mechanism can be given here.

Por que é vulnerável

The articles do not state the root cause of any of the eight CVEs, why they went unnoticed, or what the fixes change. The Mozilla bulletins named in the advisory are the place to find that. The vendor did not specify a security-bypass impact.

Como foi descoberta

The articles do not say who found the flaws or how they were reported. CERT-FR says only that multiple vulnerabilities were discovered in Mozilla products. Disclosure came through Mozilla's security bulletins mfsa2026-111 to mfsa2026-115 of 20 October 2026, and CERT-FR published its advisory on 21 October 2026. The advisory does not mention active exploitation, IOCs or attribution.

Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:22.

Detalhes técnicos

  • Affected: Firefox ESR before 115.43.1; Firefox ESR before 153.5.1; Firefox before 158.0.1; Thunderbird before 153.5.1; Thunderbird before 158.0.1.
  • CVEs referenced: CVE-2026-113399, CVE-2026-113400, CVE-2026-113401, CVE-2026-113470, CVE-2026-113866, CVE-2026-113867, CVE-2026-113868, CVE-2026-113869.
  • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

Remediação

  • Consult the Mozilla security bulletins mfsa2026-111, mfsa2026-112, mfsa2026-113, mfsa2026-114 and mfsa2026-115 (20 October 2026) to obtain the patches.
  • Update Firefox, Firefox ESR and Thunderbird to the fixed versions: Firefox 158.0.1 or later, Firefox ESR 115.43.1 or 153.5.1 or later, Thunderbird 153.5.1 or 158.0.1 or later.

Linha do tempo

  1. cert.ssi.gouv.fr ↗ · pub. 20/10/2026 21:00 · coletado 22/10 13:01 primeiro registro

    CERT-FR: Multiple Mozilla Firefox, Firefox ESR and Thunderbird vulnerabilities allow arbitrary code execution and data disclosure

    ler a análise desta fonte

    CERT-FR advisory CERTFR-2026-AVI-1346 reports multiple vulnerabilities in Mozilla products (Firefox, Firefox ESR and Thunderbird), fixed in Mozilla security bulletins mfsa2026-111 to mfsa2026-115 of 20 October 2026. According to the advisory, some of the flaws allow an attacker to achieve arbitrary code execution, breach of data confidentiality and denial of service. The advisory does not mention active exploitation, IOCs or attribution, and the vendor did not specify a security-bypass impact.

    Technical Details

    • Affected: Firefox ESR before 115.43.1; Firefox ESR before 153.5.1; Firefox before 158.0.1; Thunderbird before 153.5.1; Thunderbird before 158.0.1.
    • CVEs referenced: CVE-2026-113399, CVE-2026-113400, CVE-2026-113401, CVE-2026-113470, CVE-2026-113866, CVE-2026-113867, CVE-2026-113868, CVE-2026-113869.
    • The advisory does not map impacts to individual CVEs, nor does it give CVSS scores or attack vectors.

    Remediation

    • Consult the Mozilla security bulletins mfsa2026-111, mfsa2026-112, mfsa2026-113, mfsa2026-114 and mfsa2026-115 (20 October 2026) to obtain the patches.
    • Update Firefox, Firefox ESR and Thunderbird to the fixed versions: Firefox 158.0.1 or later, Firefox ESR 115.43.1 or 153.5.1 or later, Thunderbird 153.5.1 or 158.0.1 or later.