SB20261021132 - Debian update for firefox-esr

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261021132

SB20261021132 - Debian update for firefox-esr

Published: October 21, 2026

Security Bulletin ID SB20261021132
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Check for Certificate Revocation (CVE-ID: CVE-2026-113470)

CWE-ID: CWE-299 - Improper Check for Certificate Revocation

CVSSv4: 7.4 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially impersonate trusted websites and intercept sensitive communications using compromised certificates.

The vulnerability exists due to incomplete certificate revocation enforcement in the Security Block-lists, Allow-lists, and other State component when validating certificate chains involving compromised eMudhra intermediate certificates. A remote attacker can present a certificate chain relying on a compromised intermediate certificate to potentially have an untrusted connection accepted as trusted.

The affected scenario involves RemoteSettings being disabled by policy or otherwise unavailable.


Remediation

Install update from vendor's website.

References