CVE-2026-113470
Fixed in a distro release EPSS <1%CVSS 5.4
Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, Thunderbird 153.5.1, and Firefox 158.0.2.
Products: Mozilla Firefox, Mozilla Thunderbird
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | firefox-esr | 153.5.1esr-1~deb12u1 |
| Debian 12 | thunderbird | no fix |
| Debian 13 | firefox-esr | 153.5.1esr-1~deb13u1 |
| Debian 13 | thunderbird | 1:153.5.1esr-1~deb13u1 |
| Debian 14 | firefox-esr | no fix |
| Debian 14 | thunderbird | no fix |
| Ubuntu 18.04 LTS | mozjs38 | no fix |
| Ubuntu 18.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs52 | no fix |
| Ubuntu 20.04 LTS | mozjs68 | no fix |
| Ubuntu 22.04 LTS | mozjs102 | no fix |
| Ubuntu 22.04 LTS | mozjs78 | no fix |
| Ubuntu 22.04 LTS | mozjs91 | no fix |
| Ubuntu 22.04 LTS | thunderbird | no fix |
| Ubuntu 24.04 LTS | mozjs102 | no fix |
| Ubuntu 24.04 LTS | mozjs115 | no fix |
| openSUSE Leap 16.0 | MozillaFirefox | 153.5.1-160000.1.1 |
| openSUSE Leap 16.0 | mozilla-nss | 3.125-160000.3.1 |
| openSUSE Tumbleweed | MozillaFirefox | 158.0.1-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 153.5.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 153.5.1-1.1 |