Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Firefox Update Fixes Security Flaw Allowing Malicious Code Execution

published 6 months ago

Summary

A security update for Firefox has been released to address a vulnerability that could allow an attacker to execute malicious code on a user's system. This update is important for all Firefox users to apply to ensure their system remains secure. Users should update their Firefox browser as soon as possible to fix this issue.

What to do

Update redhat firefox to version 0:140.9.1-1.el8_6.
Update redhat firefox-debuginfo to version 0:140.9.1-1.el8_6.
Update redhat firefox-debugsource to version 0:140.9.1-1.el8_6.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_aus:8.6::appstream	redhat	firefox	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_aus:8.6::appstream	redhat	firefox-debuginfo	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_aus:8.6::appstream	redhat	firefox-debugsource	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_e4s:8.6::appstream	redhat	firefox	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_e4s:8.6::appstream	redhat	firefox-debuginfo	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_e4s:8.6::appstream	redhat	firefox-debugsource	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_tus:8.6::appstream	redhat	firefox	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_tus:8.6::appstream	redhat	firefox-debuginfo	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6
Red Hat:rhel_tus:8.6::appstream	redhat	firefox-debugsource	< 0:140.9.1-1.el8_6 Fix: upgrade to 0:140.9.1-1.el8_6

Original advisory text

Red Hat Security Advisory: firefox security update

References

https://access.redhat.com/errata/RHSA-2026:13683 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451805 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2451819 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455897 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455901 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2455908 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13683.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-5731 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-5731 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5731 Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5731 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5731 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-5732 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-5732 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5732 Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5732 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5732 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-5734 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-5734 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-5734 Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-27/#CVE-2026-5734 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2026-29/#CVE-2026-5734 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-33416 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33416 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33416 Vendor Advisory
https://github.com/pnggroup/libpng/commit/23019269764e35ed8458e517f1897bd3c54820... Third Party Advisory
https://github.com/pnggroup/libpng/commit/7ea9eea884a2328cc7fdcb3c0c00246a50d906... Third Party Advisory
https://github.com/pnggroup/libpng/commit/a3a21443ed12bfa1ef46fa0d4fb2b74a0fa34a... Third Party Advisory
https://github.com/pnggroup/libpng/commit/c1b0318b393c90679e6fa5bc1d329fd5d5012e... Third Party Advisory
https://github.com/pnggroup/libpng/pull/824 Third Party Advisory
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j Third Party Advisory
https://access.redhat.com/security/cve/CVE-2026-33636 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-33636 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-33636 Vendor Advisory
https://github.com/pnggroup/libpng/commit/7734cda20cf1236aef60f3bbd2267c97bbb408... Third Party Advisory
https://github.com/pnggroup/libpng/commit/aba9f18eba870d14fb52c5ba5d73451349e339... Third Party Advisory
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

8.8 High

Timeline

Published6 May 2026

Updated8 May 2026

First seen8 May 2026

Sources

RHSA-2026:13683 · OSV

Track software like this

Free during beta