Debian dla-4896 : firefox-esr - security update

critical Nessus Plugin ID 379586

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4896 advisory.

- ------------------------------------------------------------------------- Debian LTS Advisory DLA-4896-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort November 12, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : firefox-esr Version : 153.7.0esr-1~deb12u1 CVE ID : CVE-2026-118007 CVE-2026-118019 CVE-2026-118021 CVE-2026-118024 CVE-2026-124853 CVE-2026-124854 CVE-2026-124855 CVE-2026-124856 CVE-2026-124857 CVE-2026-124858 CVE-2026-124859 CVE-2026-124860 CVE-2026-124861 CVE-2026-124862 CVE-2026-124863 CVE-2026-124864 CVE-2026-124865 CVE-2026-124866 CVE-2026-124868 CVE-2026-124869 CVE-2026-124870 CVE-2026-124872 CVE-2026-124873 CVE-2026-124874 CVE-2026-124875 CVE-2026-124876 CVE-2026-124877 CVE-2026-124879 CVE-2026-124880 CVE-2026-124881 CVE-2026-124882 CVE-2026-124883 CVE-2026-124884 CVE-2026-124885 CVE-2026-124886 CVE-2026-124887 CVE-2026-124888 CVE-2026-124889 CVE-2026-124890 CVE-2026-124891 CVE-2026-124892 CVE-2026-124893 CVE-2026-124894 CVE-2026-124895 CVE-2026-124896 CVE-2026-124897 CVE-2026-124898 CVE-2026-124899 CVE-2026-124901 CVE-2026-124902 CVE-2026-124903 CVE-2026-124905 CVE-2026-124906 CVE-2026-124907 CVE-2026-124909 CVE-2026-124910 CVE-2026-124912 CVE-2026-124913 CVE-2026-124914 CVE-2026-124915 CVE-2026-124917 CVE-2026-124918 CVE-2026-124919 CVE-2026-124922 CVE-2026-124924 CVE-2026-124926 CVE-2026-124927 CVE-2026-124929 CVE-2026-124930 CVE-2026-124931 CVE-2026-124932 CVE-2026-124933 CVE-2026-124934 CVE-2026-124935 CVE-2026-124938 CVE-2026-124939 CVE-2026-124940 CVE-2026-124941 CVE-2026-124942 CVE-2026-124948 CVE-2026-124951

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, privilege escalation, bypass of the same-origin policy, information disclosure or spoofing.

For Debian 12 bookworm, these problems have been fixed in version 153.7.0esr-1~deb12u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the firefox-esr packages.

Plugin Details

Severity: Critical

ID: 379586

File Name: debian_DLA-4896.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 11/12/2026

Updated: 11/12/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.31

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-124948

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-124917

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ach, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-af, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-all, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-an, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ar, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ast, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-az, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-be, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bg, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-br, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-bs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ca-valencia, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ca, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cak, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-cy, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-da, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-de, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-dsb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-el, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-en-ca, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-en-gb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-eo, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-ar, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-cl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-es, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-es-mx, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-et, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-eu, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fa, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ff, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fi, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fur, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-fy-nl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ga-ie, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gd, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-gu-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-he, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hi-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hsb, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hu, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-hy-am, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ia, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-id, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-is, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-it, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ja, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ka, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kab, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-km, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-kn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ko, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lij, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lt, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-lv, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-mk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-mr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ms, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-my, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nb-no, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ne-np, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-nn-no, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-oc, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pa-in, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pt-br, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-pt-pt, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-rm, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ro, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ru, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sat, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sc, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sco, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-si, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-skr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-son, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sq, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-sv-se, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-szl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ta, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-te, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tg, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-th, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tl, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-tr, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-trs, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-uk, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-ur, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-uz, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-vi, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-xh, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-zh-cn, p-cpe:/a:debian:debian_linux:firefox-esr-l10n-zh-tw, p-cpe:/a:debian:debian_linux:firefox-esr

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 11/12/2026

Vulnerability Publication Date: 10/27/2026

Reference Information

CVE: CVE-2026-118007, CVE-2026-118019, CVE-2026-118021, CVE-2026-118024, CVE-2026-124853, CVE-2026-124854, CVE-2026-124855, CVE-2026-124856, CVE-2026-124857, CVE-2026-124858, CVE-2026-124859, CVE-2026-124860, CVE-2026-124861, CVE-2026-124862, CVE-2026-124863, CVE-2026-124864, CVE-2026-124865, CVE-2026-124866, CVE-2026-124868, CVE-2026-124869, CVE-2026-124870, CVE-2026-124872, CVE-2026-124873, CVE-2026-124874, CVE-2026-124875, CVE-2026-124876, CVE-2026-124877, CVE-2026-124879, CVE-2026-124880, CVE-2026-124881, CVE-2026-124882, CVE-2026-124883, CVE-2026-124884, CVE-2026-124885, CVE-2026-124886, CVE-2026-124887, CVE-2026-124888, CVE-2026-124889, CVE-2026-124890, CVE-2026-124891, CVE-2026-124892, CVE-2026-124893, CVE-2026-124894, CVE-2026-124895, CVE-2026-124896, CVE-2026-124897, CVE-2026-124898, CVE-2026-124899, CVE-2026-124901, CVE-2026-124902, CVE-2026-124903, CVE-2026-124905, CVE-2026-124906, CVE-2026-124907, CVE-2026-124909, CVE-2026-124910, CVE-2026-124912, CVE-2026-124913, CVE-2026-124914, CVE-2026-124915, CVE-2026-124917, CVE-2026-124918, CVE-2026-124919, CVE-2026-124922, CVE-2026-124924, CVE-2026-124926, CVE-2026-124927, CVE-2026-124929, CVE-2026-124930, CVE-2026-124931, CVE-2026-124932, CVE-2026-124933, CVE-2026-124934, CVE-2026-124935, CVE-2026-124938, CVE-2026-124939, CVE-2026-124940, CVE-2026-124941, CVE-2026-124942, CVE-2026-124948, CVE-2026-124951

Detections

Analytics