Debian dla-4866 : firefox-esr - security update

high Nessus Plugin ID 373648

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4866 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4866-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 29, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : firefox-esr Version : 153.6.0esr-1~deb12u2 CVE ID : CVE-2026-100801 CVE-2026-117860 CVE-2026-117861 CVE-2026-117862 CVE-2026-117863 CVE-2026-117864 CVE-2026-117865 CVE-2026-117866 CVE-2026-117867 CVE-2026-117868 CVE-2026-117869 CVE-2026-117870 CVE-2026-117871 CVE-2026-117872 CVE-2026-117873 CVE-2026-117874 CVE-2026-117875 CVE-2026-117876 CVE-2026-117877 CVE-2026-117878 CVE-2026-117879 CVE-2026-117880 CVE-2026-117881 CVE-2026-117882 CVE-2026-117883 CVE-2026-117884 CVE-2026-117885 CVE-2026-117886 CVE-2026-117887 CVE-2026-117888 CVE-2026-117889 CVE-2026-117890 CVE-2026-117891 CVE-2026-117892 CVE-2026-117893 CVE-2026-117894 CVE-2026-117895 CVE-2026-117896 CVE-2026-117897 CVE-2026-117898 CVE-2026-117899 CVE-2026-117900 CVE-2026-117901 CVE-2026-117902 CVE-2026-117903 CVE-2026-117904 CVE-2026-117905 CVE-2026-117906 CVE-2026-117907 CVE-2026-117908 CVE-2026-117909 CVE-2026-117910 CVE-2026-117911 CVE-2026-117912 CVE-2026-117913 CVE-2026-117914 CVE-2026-117915 CVE-2026-117916 CVE-2026-117917 CVE-2026-117918 CVE-2026-117919 CVE-2026-117920 CVE-2026-117921 CVE-2026-117922 CVE-2026-117923 CVE-2026-117924 CVE-2026-117925 CVE-2026-117926 CVE-2026-117927 CVE-2026-117928 CVE-2026-117929 CVE-2026-117930 CVE-2026-117931 CVE-2026-117932 CVE-2026-117933 CVE-2026-117934 CVE-2026-117935 CVE-2026-117936 CVE-2026-117937 CVE-2026-117938 CVE-2026-117939 CVE-2026-117940 CVE-2026-117941 CVE-2026-117942 CVE-2026-117943 CVE-2026-117944 CVE-2026-117945 CVE-2026-117946 CVE-2026-117947 CVE-2026-117948 CVE-2026-117949 CVE-2026-117950 CVE-2026-117951 CVE-2026-117952 CVE-2026-117953 CVE-2026-117954 CVE-2026-117955 CVE-2026-117956 CVE-2026-117957 CVE-2026-117958 CVE-2026-117959 CVE-2026-117960 CVE-2026-117961 CVE-2026-117962 CVE-2026-117963 CVE-2026-117964 CVE-2026-117965 CVE-2026-117966 CVE-2026-117967 CVE-2026-117968 CVE-2026-117969 CVE-2026-117970 CVE-2026-117971 CVE-2026-117972 CVE-2026-117973 CVE-2026-117974 CVE-2026-117975 CVE-2026-117976 CVE-2026-117977 CVE-2026-117978 CVE-2026-117979 CVE-2026-117980 CVE-2026-117981 CVE-2026-117982 CVE-2026-117983 CVE-2026-117984 CVE-2026-117985 CVE-2026-117986 CVE-2026-117987 CVE-2026-117988 CVE-2026-117989 CVE-2026-117990 CVE-2026-117991 CVE-2026-117992 CVE-2026-117993 CVE-2026-117994 CVE-2026-117995 CVE-2026-117996 CVE-2026-117997 CVE-2026-117998 CVE-2026-117999 CVE-2026-118000 CVE-2026-118002 CVE-2026-118003 CVE-2026-118004

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information disclosure or spoofing.

For Debian 12 bookworm, these problems have been fixed in version 153.6.0esr-1~deb12u2.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the firefox-esr packages.

Plugin Details

Severity: High

ID: 373648

File Name: debian_DLA-4866.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 10/29/2026

Updated: 10/29/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 92.91

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-100801

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ach, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-af, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-all, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-an, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ar, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ast, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-az, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-be, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bg, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-br, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ca-valencia, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ca, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cak, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cy, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-da, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-de, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-dsb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-el, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-en-ca, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-en-gb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-eo, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-ar, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-cl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-es, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-mx, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-et, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-eu, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fa, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ff, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fi, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fur, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fy-nl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ga-ie, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gd, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gu-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-he, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hi-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hsb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hu, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hy-am, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ia, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-id, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-is, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-it, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ja, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ka, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kab, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-km, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ko, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lij, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lt, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lv, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-mk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-mr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ms, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-my, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nb-no, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ne-np, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nn-no, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-oc, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pa-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pt-br, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pt-pt, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-rm, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ro, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ru, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sat, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sc, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sco, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-si, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-skr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-son, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sq, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sv-se, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-szl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ta, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-te, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tg, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-th, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-trs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-uk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ur, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-uz, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-vi, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-xh, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-zh-cn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-zh-tw, p-cpe:/a:debian:debian_linux:firefox-esr

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 10/29/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-100801, CVE-2026-117860, CVE-2026-117861, CVE-2026-117862, CVE-2026-117863, CVE-2026-117864, CVE-2026-117865, CVE-2026-117866, CVE-2026-117867, CVE-2026-117868, CVE-2026-117869, CVE-2026-117870, CVE-2026-117871, CVE-2026-117872, CVE-2026-117873, CVE-2026-117874, CVE-2026-117875, CVE-2026-117876, CVE-2026-117877, CVE-2026-117878, CVE-2026-117879, CVE-2026-117880, CVE-2026-117881, CVE-2026-117882, CVE-2026-117883, CVE-2026-117884, CVE-2026-117885, CVE-2026-117886, CVE-2026-117887, CVE-2026-117888, CVE-2026-117889, CVE-2026-117890, CVE-2026-117891, CVE-2026-117892, CVE-2026-117893, CVE-2026-117894, CVE-2026-117895, CVE-2026-117896, CVE-2026-117897, CVE-2026-117898, CVE-2026-117899, CVE-2026-117900, CVE-2026-117901, CVE-2026-117902, CVE-2026-117903, CVE-2026-117904, CVE-2026-117905, CVE-2026-117906, CVE-2026-117907, CVE-2026-117908, CVE-2026-117909, CVE-2026-117910, CVE-2026-117911, CVE-2026-117912, CVE-2026-117913, CVE-2026-117914, CVE-2026-117915, CVE-2026-117916, CVE-2026-117917, CVE-2026-117918, CVE-2026-117919, CVE-2026-117920, CVE-2026-117921, CVE-2026-117922, CVE-2026-117923, CVE-2026-117924, CVE-2026-117925, CVE-2026-117926, CVE-2026-117927, CVE-2026-117928, CVE-2026-117929, CVE-2026-117930, CVE-2026-117931, CVE-2026-117932, CVE-2026-117933, CVE-2026-117934, CVE-2026-117935, CVE-2026-117936, CVE-2026-117937, CVE-2026-117938, CVE-2026-117939, CVE-2026-117940, CVE-2026-117941, CVE-2026-117942, CVE-2026-117943, CVE-2026-117944, CVE-2026-117945, CVE-2026-117946, CVE-2026-117947, CVE-2026-117948, CVE-2026-117949, CVE-2026-117950, CVE-2026-117951, CVE-2026-117952, CVE-2026-117953, CVE-2026-117954, CVE-2026-117955, CVE-2026-117956, CVE-2026-117957, CVE-2026-117958, CVE-2026-117959, CVE-2026-117960, CVE-2026-117961, CVE-2026-117962, CVE-2026-117963, CVE-2026-117964, CVE-2026-117965, CVE-2026-117966, CVE-2026-117967, CVE-2026-117968, CVE-2026-117969, CVE-2026-117970, CVE-2026-117971, CVE-2026-117972, CVE-2026-117973, CVE-2026-117974, CVE-2026-117975, CVE-2026-117976, CVE-2026-117977, CVE-2026-117978, CVE-2026-117979, CVE-2026-117980, CVE-2026-117981, CVE-2026-117982, CVE-2026-117983, CVE-2026-117984, CVE-2026-117985, CVE-2026-117986, CVE-2026-117987, CVE-2026-117988, CVE-2026-117989, CVE-2026-117990, CVE-2026-117991, CVE-2026-117992, CVE-2026-117993, CVE-2026-117994, CVE-2026-117995, CVE-2026-117996, CVE-2026-117997, CVE-2026-117998, CVE-2026-117999, CVE-2026-118000, CVE-2026-118002, CVE-2026-118003, CVE-2026-118004

Detections

Analytics