gnu: librewolf: Update to 158.0-1 [security fixes].

e44c05da · jbartunek <[email protected]> · 2026-10-14 19:33:40 +02:00

Librewolf 158.0-1 contains fixes for the following vulnerabilites:
CVE-2026-100756: Incorrect boundary conditions in the Audio/Video: Playback
                 component
CVE-2026-100757: Use-after-free in the Widget component
CVE-2026-100758: Sandbox escape in the DOM: Navigation component
CVE-2026-100759: Uninitialized memory in the Storage: Quota Manager
                 component
CVE-2026-100760: Sandbox escape in the Security: Process Sandboxing
                 component
CVE-2026-100761: Privilege escalation due to use-after-free in the
                 Graphics: WebGPU component
CVE-2026-100762: Sandbox escape due to use-after-free in the DOM: Content
                 Processes component
CVE-2026-100763: Incorrect boundary conditions in the Graphics: WebGPU
                 component
CVE-2026-100764: Privilege escalation due to incorrect boundary conditions
                 in the Graphics: WebGPU component
CVE-2026-100765: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100766: Information disclosure in the Networking: JAR component
CVE-2026-100767: Use-after-free in the Networking: Cache component
CVE-2026-100768: Use-after-free in the Graphics: WebGPU component
CVE-2026-100769: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100770: Sandbox escape due to use-after-free in the DOM: Content
                 Processes component
CVE-2026-100771: Undefined behavior in the DOM: Streams component
CVE-2026-100772: Use-after-free in the DOM: Core & HTML component
CVE-2026-100773: Use-after-free in the Storage: IndexedDB component
CVE-2026-100774: Use-after-free in the DOM: Core & HTML component
CVE-2026-100775: Sandbox escape in the Graphics component
CVE-2026-100776: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100777: Use-after-free in the Graphics: Canvas2D component
CVE-2026-100778: Sandbox escape due to use-after-free in the DOM: Core &
                 HTML component
CVE-2026-100779: Use-after-free in the XSLT component
CVE-2026-100780: Use-after-free in the DOM: Core & HTML component
CVE-2026-100781: Sandbox escape due to incorrect boundary conditions in the
                 Graphics: WebRender component
CVE-2026-100782: Privilege escalation due to incorrect boundary conditions
                 in the Graphics component
CVE-2026-100783: Uninitialized memory in the Audio/Video component
CVE-2026-100784: Use-after-free in the Layout: Text and Fonts component
CVE-2026-100785: Use-after-free in the DOM: Core & HTML component
CVE-2026-100786: Sandbox escape due to use-after-free in the Graphics
                 component
CVE-2026-100787: Sandbox escape in the XUL component
CVE-2026-100788: Invalid pointer in the JavaScript: WebAssembly component
CVE-2026-100789: Use-after-free in the Graphics: Canvas2D component
CVE-2026-100790: Use-after-free in the XSLT component
CVE-2026-100791: Use-after-free in the DOM: Core & HTML component
CVE-2026-100792: JIT miscompilation in the JavaScript: WebAssembly component
CVE-2026-100793: JIT miscompilation in the JavaScript Engine component
CVE-2026-100794: Sandbox escape due to incorrect boundary conditions in the
                 Internationalization component
CVE-2026-96869:  Information disclosure in the Networking component
CVE-2026-100795: Denial-of-service in the Networking component
CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component
CVE-2026-100797: Privilege escalation due to use-after-free in the
                 Graphics: WebRender component
CVE-2026-100798: Cryptography misuse in Storage: Quota Manager component
CVE-2026-100799: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100800: Sandbox escape due to use-after-free in the Disability
                 Access APIs component
CVE-2026-100801: Privilege escalation in the DLL Services component
CVE-2026-100802: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100803: Same-origin policy bypass in the WebExtensions component
CVE-2026-100804: Sandbox escape due to use-after-free in the Preferences:
                 Backend component
CVE-2026-100805: Race condition, use-after-free in the Audio/Video component
CVE-2026-100806: Uninitialized memory in the Graphics: WebGPU component
CVE-2026-100807: Privilege escalation in the DOM: Service Workers component
CVE-2026-100808: Mitigation bypass in the DOM: Service Workers component
CVE-2026-100809: Same-origin policy bypass in the DevTools component
CVE-2026-100810: Other issue in the DevTools component
CVE-2026-100811: Sandbox escape due to use-after-free in the DOM: Core &
                 HTML component
CVE-2026-100812: Denial-of-service in the Graphics component
CVE-2026-100813: Invalid pointer in the JavaScript Engine: JIT component
CVE-2026-100814: Incorrect boundary conditions in the JavaScript Engine:
                 JIT component
CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component
CVE-2026-100816: Site isolation issue in the DOM: Networking component
CVE-2026-100817: Other issue in the JavaScript: WebAssembly component
CVE-2026-100818: Sandbox escape due to use-after-free in the Widget: Gtk
                 component
CVE-2026-100819: Sandbox escape due to incorrect boundary conditions in the
                 XPCOM component
CVE-2026-100820: Privilege escalation in the Address Bar component
CVE-2026-100821: Site isolation issue in the Panning and Zooming component
CVE-2026-100822: Spoofing issue in the Networking: HTTP component
CVE-2026-100823: Spoofing issue in the Downloads component in Firefox for
                 Android
CVE-2026-100824: Privilege escalation in the Places component
CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component
CVE-2026-100826: Denial-of-service in the Storage: StorageManager component
CVE-2026-100828: Mitigation bypass in the Bookmarks & History component
CVE-2026-100829: Mitigation bypass in the DOM: Security component
CVE-2026-100830: Mitigation bypass in the DOM: Navigation component
CVE-2026-100831: Use-after-free in the DOM: UI Events & Focus Handling
                 component

* gnu/packages/librewolf.scm (librewolf): Update to 158.0-1.
  (firefox-l10n): Update to 0da379c064af4968c17feca6128a1290adfb3009.

Merges: #11853
Reviewed-by: Hugo Buddelmeijer <[email protected]>
Signed-off-by: moksh <[email protected]>

Commit: e44c05daa9236bee2e9962a1a8fc5b8c0769ad24
Parents: 02500197

Changes

1 files changed · +6 −6

File	Status	Add	Del	Content
gnu/packages/librewolf.scm	modified	+6	−6	View file

gnu/packages/librewolf.scm

View file

diff --git a/gnu/packages/librewolf.scm b/gnu/packages/librewolf.scm
index cee4495..fc91fd3 100644
--- a/gnu/packages/librewolf.scm
+++ b/gnu/packages/librewolf.scm
@@ -125,14 +125,14 @@
   ;; tar xf /gnu/store/...-firefox-123.4.source.tar.xz --wildcards -O \
   ;;     firefox-*/browser/locales/l10n-changesets.json \
   ;;     | grep revision | sort | uniq
-  (let ((commit "c2b9350bb4495e702c8336f4536c217e60bbe33a"))
+  (let ((commit "0da379c064af4968c17feca6128a1290adfb3009"))
    (origin
       (method git-fetch)
       (uri (git-reference
             (url "https://github.com/mozilla-l10n/firefox-l10n.git")
             (commit commit)))
       (file-name (git-file-name "firefox-l10n" commit))
-      (sha256 (base32 "1z25hxyamm63jny6msl3jh6v33hlvn9ca0y34x3ggbxw1x9zzj8s")))))
+      (sha256 (base32 "1fm36dlqgc05r8m6w7bqm043h63spw7nnic67bxrlyjx7ysz11jq")))))
 
 (define* (make-librewolf-source #:key version firefox-hash librewolf-hash l10n)
   (let* ((ff-src (firefox-source-origin
@@ -245,17 +245,17 @@
 ;; It's used for cache validation and therefore can lead to strange bugs.
 ;; ex: date '+%Y%m%d%H%M%S'
 ;; or: (format-time-string "%Y%m%d%H%M%S")
-(define %librewolf-build-id "20261011155700")
+(define %librewolf-build-id "20261014155700")
 
 (define-public librewolf
   (package
     (name "librewolf")
-    (version "157.0.1-1")
+    (version "158.0-1")
     (source
      (make-librewolf-source
       #:version version
-      #:firefox-hash "0k0w4kp65daf2q6dl2spsfpfpikk20xl872kwiwj9psrj3pfsfs8"
-      #:librewolf-hash "0r7n19g1in3kfrbb4bkjykgab7px292dyy0siwwrzj7sr2nd0g72"
+      #:firefox-hash "1fx2bbfw3qx1nj8lms278v3ixsv1w9kw6g38mw0ad03m3n0gfxzw"
+      #:librewolf-hash "1m30d7xg74v5zdz50dg88djvk94xxg8jy8hrmbrnrglj2z6kwsws"
       #:l10n firefox-l10n))
     (build-system gnu-build-system)
     (arguments