It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1928 advisory.

    Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12289)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12290)

    Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12291)

    Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12292)

    Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12294)

    Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12295)

    Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12296)

    Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was     fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12297)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12298)

    JIT miscompilation in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152, Firefox     ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12299)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12302)

    Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox     152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12304)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12305)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12306)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12307)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12308)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12309)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12310)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12311)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12312)

    Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability     was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12313)

    Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12314)

    Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR     140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12315)

    Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in     Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12324)

    Denial-of-service in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12325)

    Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151.
    Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of     these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152,     Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12. (CVE-2026-12327)

    Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151     and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with     enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed     in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
    (CVE-2026-12328)

    Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and     Thunderbird 140.12. (CVE-2026-12329)

    Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in     Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12. (CVE-2026-12330)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur, (CVE-2026-50219)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation). (CVE-2026-56131)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across parsers.
    (CVE-2026-56132)

    A heap buffer overflow vulnerability was found in libaom, the reference AV1 codec implementation. A flaw     in the AV1 encoder's Look-Ahead Processing (LAP) mode causes the first-pass stats ring buffer wrap-around     guard to be bypassed when g_lag_in_frames is set to 1 or higher. This results in a 232-byte out-of-bounds     write on every encoded frame after the second, corrupting adjacent heap objects. An attacker who can     influence encoder configuration in a transcoding service or WebRTC session could exploit this to cause a     denial of service (process crash) or potentially achieve code execution. (CVE-2026-56208)

    A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A     missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a     spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of     approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC     encoder parameters in a network-facing service could exploit this for information disclosure (heap content     leak) or denial of service (segmentation fault from hitting unmapped memory). (CVE-2026-56210)

    A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation.
    Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an     attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures.
    In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map     pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve     arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding     enabled and accept attacker-supplied video frames. (CVE-2026-56211)

    libexpat before 2.8.2 has an integer overflow in storeAtts. (CVE-2026-56403)

    libexpat before 2.8.2 has an integer overflow in addBinding. (CVE-2026-56404)

    libexpat before 2.8.2 has an integer overflow in getAttributeId. (CVE-2026-56405)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse. (CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen. (CVE-2026-56407)

    libexpat before 2.8.2 has an integer overflow in copyString. (CVE-2026-56408)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. (CVE-2026-56412)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation).(CVE-2026-56131)

    libexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)

    xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION     declarations.(CVE-2026-56411)

    xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)

    libexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen.(CVE-2026-56407)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse.(CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur,(CVE-2026-50219)

    xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is     used.(CVE-2026-56409)

    libexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across     parsers.(CVE-2026-56132)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse.(CVE-2026-56406)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen.(CVE-2026-56407)

    xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION     declarations.(CVE-2026-56411)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)

    xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is     used.(CVE-2026-56409)

    libexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across     parsers.(CVE-2026-56132)

    libexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)

    xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)

    libexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation).(CVE-2026-56131)

    libexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the expat packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory     corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A     struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past     allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a     wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for     CVE-2026-66046.(CVE-2026-76641)

    Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity     in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized     values triggers an O(N^2) linear scan of elementType-defaultAtts to determine CDATA status. A remote     unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application     parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring     authentication, external entity resolution, or non-default parser options.(CVE-2026-66046)

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call     depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-     free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.(CVE-2026-56412)

    libexpat before 2.8.2 has an integer overflow in copyString.(CVE-2026-56408)

    libexpat before 2.8.2 has an integer overflow in getAttributeId.(CVE-2026-56405)

    xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is     used.(CVE-2026-56409)

    xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.(CVE-2026-56410)

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was     present in XML_Parse.(CVE-2026-56406)

    xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION     declarations.(CVE-2026-56411)

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity     textLen.(CVE-2026-56407)

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold     backing array reallocation is mishandled when there is data-structure sharing across     parsers.(CVE-2026-56132)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers     in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219     situation).(CVE-2026-56131)

    libexpat before 2.8.2 has an integer overflow in storeAtts.(CVE-2026-56403)

    libexpat before 2.8.2 has an integer overflow in addBinding.(CVE-2026-56404)

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,     XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation.
    Thus, a use-after-free can occur,(CVE-2026-50219)

Tenable has extracted the preceding description block directly from the EulerOS expat security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22139-1 advisory.

    Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

    - CVE-2026-109704: Privilege escalation in the Application Update component.
    - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-     free in the       Networking component.
    - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
    - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
    - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
    - CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing     component.
    - CVE-2026-109710: Use-after-free in the Graphics: Text component.
    - CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
    - CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
    - CVE-2026-109713: Use-after-free in the Crash Reporting component.
    - CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
    - CVE-2026-109718: Use-after-free in the XML component.
    - CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
    - CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
    - CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
    - CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
    - CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109726: Use-after-free in the SVG component.
    - CVE-2026-109727: Use-after-free in the Audio/Video component.
    - CVE-2026-109728: Use-after-free in the DOM: Animation component.
    - CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
    - CVE-2026-109730: Integer overflow in the Graphics component.
    - CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
    - CVE-2026-109732: Use-after-free in the DOM: Streams component.
    - CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109734: Mitigation bypass in the DOM: Security component.
    - CVE-2026-109736: Frame poisoning in the Layout component.
    - CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
    - CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
    - CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
    - CVE-2026-109742: Information disclosure in the PDF Viewer component.
    - CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
    - CVE-2026-109744: Other issue in the DOM: File component.
    - CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
    - CVE-2026-109751: Information disclosure in the Networking component.
    - CVE-2026-109752: Use-after-free in the DOM: Workers component.
    - CVE-2026-109753: Incorrect boundary conditions in the Layout component.
    - CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
    - CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
    - CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
    - CVE-2026-109759: Site isolation issue in the Networking component.
    - CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
    - CVE-2026-109762: Incorrect boundary conditions in the SVG component.
    - CVE-2026-109763: Mitigation bypass in the File Handling component.
    - CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.
    - CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109767: Information disclosure in the Networking component.
    - CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.
    - CVE-2026-109775: Denial-of-service in the WebRTC component.
    - CVE-2026-109776: Race condition in the XPCOM component.
    - CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.
    - CVE-2026-109778: Privilege escalation in the WebExtensions component.
    - CVE-2026-109781: Denial-of-service in the Printing: Output component.
    - CVE-2026-109782: Mitigation bypass in the File Handling component.
    - CVE-2026-109783: Mitigation bypass in the File Handling component.

    libexpat updated:

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside       an entity declaration value. (bsc#1259727)
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition. (bsc#1259730)
    - CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML     document. (bsc#1262263)
    - CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of     service via moderately       sized crafted XML input. (bsc#1264713)
    - CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in     libexpat could lead to       information disclosure, integrity loss, or denial of service. (bsc#1275098)
    - CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for     XML_ResumeParser in       libexpat could lead to denial of service. (bsc#1275098)
    - CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in     libexpat could lead to       denial of service or memory corruption. (bsc#1275098)
    - CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in     libexpat could lead       to memory corruption. (bsc#1275098)
    - CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could     lead to memory corruption       and potential security risks. (bsc#1275098)
    - CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could     lead to memory corruption. (bsc#1275098)
    - CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to     denial of service. (bsc#1275098)
    - CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in     libexpat could lead to denial of       service or memory corruption. (bsc#1275098)
    - CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in     the storeAtts() function       in xmlparse.c. (bsc#1275736)
    - CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing     functions in libexpat allowed       attackers to cause denial of service. (bsc#1275605)
    - CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat     allowed attackers to trigger       memory corruption or a crash. (bsc#1275736)
    - CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code     in libexpat allowed attackers       to cause a denial of service via hash flooding attacks. (bsc#1275736)
    - CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with     custom encoding callbacks in       libexpat could lead to memory corruption. (bsc#1275736)
    - CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat     allowed attackers to pass unpaired       surrogates or silently replace input characters. (bsc#1282347)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:24260-1 advisory.

    Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

    - CVE-2026-109704: Privilege escalation in the Application Update component.
    - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-     free in the       Networking component.
    - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
    - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
    - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
    - CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing     component.
    - CVE-2026-109710: Use-after-free in the Graphics: Text component.
    - CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
    - CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
    - CVE-2026-109713: Use-after-free in the Crash Reporting component.
    - CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
    - CVE-2026-109718: Use-after-free in the XML component.
    - CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
    - CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
    - CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
    - CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
    - CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109726: Use-after-free in the SVG component.
    - CVE-2026-109727: Use-after-free in the Audio/Video component.
    - CVE-2026-109728: Use-after-free in the DOM: Animation component.
    - CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
    - CVE-2026-109730: Integer overflow in the Graphics component.
    - CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
    - CVE-2026-109732: Use-after-free in the DOM: Streams component.
    - CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109734: Mitigation bypass in the DOM: Security component.
    - CVE-2026-109736: Frame poisoning in the Layout component.
    - CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
    - CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
    - CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
    - CVE-2026-109742: Information disclosure in the PDF Viewer component.
    - CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
    - CVE-2026-109744: Other issue in the DOM: File component.
    - CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
    - CVE-2026-109751: Information disclosure in the Networking component.
    - CVE-2026-109752: Use-after-free in the DOM: Workers component.
    - CVE-2026-109753: Incorrect boundary conditions in the Layout component.
    - CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
    - CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
    - CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
    - CVE-2026-109759: Site isolation issue in the Networking component.
    - CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
    - CVE-2026-109762: Incorrect boundary conditions in the SVG component.
    - CVE-2026-109763: Mitigation bypass in the File Handling component.
    - CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.
    - CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109767: Information disclosure in the Networking component.
    - CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.
    - CVE-2026-109775: Denial-of-service in the WebRTC component.
    - CVE-2026-109776: Race condition in the XPCOM component.
    - CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.
    - CVE-2026-109778: Privilege escalation in the WebExtensions component.
    - CVE-2026-109781: Denial-of-service in the Printing: Output component.
    - CVE-2026-109782: Mitigation bypass in the File Handling component.
    - CVE-2026-109783: Mitigation bypass in the File Handling component.

    libexpat updated:

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside       an entity declaration value. (bsc#1259727)
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition. (bsc#1259730)
    - CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML     document. (bsc#1262263)
    - CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of     service via moderately       sized crafted XML input. (bsc#1264713)
    - CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in     libexpat could lead to       information disclosure, integrity loss, or denial of service. (bsc#1275098)
    - CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for     XML_ResumeParser in       libexpat could lead to denial of service. (bsc#1275098)
    - CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in     libexpat could lead to       denial of service or memory corruption. (bsc#1275098)
    - CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in     libexpat could lead       to memory corruption. (bsc#1275098)
    - CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could     lead to memory corruption       and potential security risks. (bsc#1275098)
    - CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could     lead to memory corruption. (bsc#1275098)
    - CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to     denial of service. (bsc#1275098)
    - CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in     libexpat could lead to denial of       service or memory corruption. (bsc#1275098)
    - CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in     the storeAtts() function       in xmlparse.c. (bsc#1275736)
    - CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing     functions in libexpat allowed       attackers to cause denial of service. (bsc#1275605)
    - CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat     allowed attackers to trigger       memory corruption or a crash. (bsc#1275736)
    - CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code     in libexpat allowed attackers       to cause a denial of service via hash flooding attacks. (bsc#1275736)
    - CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with     custom encoding callbacks in       libexpat could lead to memory corruption. (bsc#1275736)
    - CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat     allowed attackers to pass unpaired       surrogates or silently replace input characters. (bsc#1282347)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4834-1 advisory.

    Firefox Extended Support Release 153.5.0 ESR (MFSA 2026-108, bsc#1284493):

    - CVE-2026-109704: Privilege escalation in the Application Update component.
    - CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-     free in the       Networking component.
    - CVE-2026-109706: Use-after-free in the Storage: IndexedDB component.
    - CVE-2026-109707: Sandbox escape due to use-after-free in the Networking component.
    - CVE-2026-109708: Sandbox escape due to incorrect boundary conditions in the Networking component.
    - CVE-2026-109709: Information disclosure, privilege escalation in the Security: Process Sandboxing     component.
    - CVE-2026-109710: Use-after-free in the Graphics: Text component.
    - CVE-2026-109711: Use-after-free in the Graphics: Canvas2D component.
    - CVE-2026-109712: Sandbox escape due to uninitialized memory in the Graphics component.
    - CVE-2026-109713: Use-after-free in the Crash Reporting component.
    - CVE-2026-109715: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109716: Incorrect boundary conditions in the JavaScript Engine component.
    - CVE-2026-109717: Use-after-free in the DOM: Bindings (WebIDL) component.
    - CVE-2026-109718: Use-after-free in the XML component.
    - CVE-2026-109719: Race condition, use-after-free in the Graphics: CanvasWebGL component.
    - CVE-2026-109720: JIT miscompilation in the JavaScript: WebAssembly component.
    - CVE-2026-109721: Incorrect boundary conditions in the JavaScript Engine: JIT component.
    - CVE-2026-109722: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109723: Integer overflow in the Layout: Text and Fonts component.
    - CVE-2026-109724: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109725: Use-after-free in the DOM: Core & HTML component.
    - CVE-2026-109726: Use-after-free in the SVG component.
    - CVE-2026-109727: Use-after-free in the Audio/Video component.
    - CVE-2026-109728: Use-after-free in the DOM: Animation component.
    - CVE-2026-109729: Use-after-free in the JavaScript Engine: JIT component.
    - CVE-2026-109730: Integer overflow in the Graphics component.
    - CVE-2026-109731: Incorrect boundary conditions in the Graphics: Canvas2D component.
    - CVE-2026-109732: Use-after-free in the DOM: Streams component.
    - CVE-2026-109733: JIT miscompilation in the JavaScript Engine: JIT component.
    - CVE-2026-109734: Mitigation bypass in the DOM: Security component.
    - CVE-2026-109736: Frame poisoning in the Layout component.
    - CVE-2026-109737: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109738: Use-after-free in the Audio/Video: Playback component.
    - CVE-2026-109740: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component.
    - CVE-2026-109741: Use-after-free in the Storage: Bucket File System component.
    - CVE-2026-109742: Information disclosure in the PDF Viewer component.
    - CVE-2026-109743: Privilege escalation in the Panning and Zooming component.
    - CVE-2026-109744: Other issue in the DOM: File component.
    - CVE-2026-109745: Sandbox escape due to uninitialized memory in the DOM: Web Serial component.
    - CVE-2026-109751: Information disclosure in the Networking component.
    - CVE-2026-109752: Use-after-free in the DOM: Workers component.
    - CVE-2026-109753: Incorrect boundary conditions in the Layout component.
    - CVE-2026-109754: Incorrect boundary conditions in the DOM: Editor component.
    - CVE-2026-109756: Privilege escalation in the DOM: Navigation component.
    - CVE-2026-109757: Sandbox escape due to race condition in the Networking component.
    - CVE-2026-109759: Site isolation issue in the Networking component.
    - CVE-2026-109760: Mitigation bypass in the Networking: HTTP component.
    - CVE-2026-109762: Incorrect boundary conditions in the SVG component.
    - CVE-2026-109763: Mitigation bypass in the File Handling component.
    - CVE-2026-109764: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109765: Race condition, use-after-free in the Graphics: Text component.
    - CVE-2026-109766: Mitigation bypass in the Enterprise Policies component.
    - CVE-2026-109767: Information disclosure in the Networking component.
    - CVE-2026-109770: Spoofing issue in the DOM: Web Serial component.
    - CVE-2026-109775: Denial-of-service in the WebRTC component.
    - CVE-2026-109776: Race condition in the XPCOM component.
    - CVE-2026-109777: Information disclosure in the Storage: IndexedDB component.
    - CVE-2026-109778: Privilege escalation in the WebExtensions component.
    - CVE-2026-109781: Denial-of-service in the Printing: Output component.
    - CVE-2026-109782: Mitigation bypass in the File Handling component.
    - CVE-2026-109783: Mitigation bypass in the File Handling component.

    libexpat updated:

    - CVE-2026-32776: libexpat: NULL pointer dereference when processing empty external parameter entities     inside an entity declaration value. (bsc#1259727)
    - CVE-2026-32777: libexpat: denial of service due to infinite loop in DTD content parsing. (bsc#1259712)
    - CVE-2026-32778: libexpat: NULL pointer dereference in `setContext` on retry after an out-of-memory     condition. (bsc#1259730)
    - CVE-2026-41080: libexpat: insufficient entropy, and thus hash flooding can occur via a crafted XML     document. (bsc#1262263)
    - CVE-2026-45186: libexpat: computational complexity of attribute name collision checks allows a denial of     service via moderately sized crafted XML input. (bsc#1264713)
    - CVE-2026-50219: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking in     libexpat could lead to information disclosure, integrity loss, or denial of service. (bsc#1275098)
    - CVE-2026-56131: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking for     XML_ResumeParser in libexpat could lead to denial of service. (bsc#1275098)
    - CVE-2026-56132: libexpat: Heap buffer overflow in doProlog due to mishandled array reallocation in     libexpat could lead to denial of service or memory corruption. (bsc#1275098)
    - CVE-2026-56403: libexpat: Integer overflow vulnerability in the storeAtts attribute parsing function in     libexpat could lead to memory corruption. (bsc#1275098)
    - CVE-2026-56404: libexpat: Integer overflow vulnerability in the addBinding routine of libexpat could     lead to memory corruption and potential security risks. (bsc#1275098)
    - CVE-2026-56405: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56406: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56407: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56408: libexpat: Integer overflow vulnerability in the copyString function in libexpat could     lead to memory corruption. (bsc#1275098)
    - CVE-2026-56409: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56410: libexpat: Integer overflow vulnerability in the xmlwf utility of libexpat could lead to     denial of service. (bsc#1275098)
    - CVE-2026-56411: libexpat: Integer overflow vulnerability in libexpat could lead to memory corruption or     denial of service. (bsc#1275098)
    - CVE-2026-56412: libexpat: Use-after-free vulnerability due to a lack of handler call depth tracking in     libexpat could lead to denial of service or memory corruption. (bsc#1275098)
    - CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in     the storeAtts() function in xmlparse.c. (bsc#1275736)
    - CVE-2026-72522: libexpat: Out-of-bounds read and resultant infinite loop in the Unicode processing     functions in libexpat allowed attackers to cause denial of service. (bsc#1275605)
    - CVE-2026-76641: libexpat: Out-of-bounds read vulnerability caused by a struct size mismatch in libexpat     allowed attackers to trigger memory corruption or a crash. (bsc#1275736)
    - CVE-2026-76956: libexpat: Insufficient entropy caused by misinterpretation of getentropy's return code     in libexpat allowed attackers to cause a denial of service via hash flooding attacks. (bsc#1275736)
    - CVE-2026-76957: libexpat: Use-after-free vulnerability due to lack of handler call depth tracking with     custom encoding callbacks in libexpat could lead to memory corruption. (bsc#1275736)
    - CVE-2026-93990: libexpat: Improper handling of lone high surrogates in UTF-16 encoded XML in libexpat     allowed attackers to pass unpaired surrogates or silently replace input characters. (bsc#1282347)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
327385	Amazon Linux 2023 : firefox (ALAS2023-2026-1928)	Nessus	Amazon Linux Local Security Checks	2026/7/16	2026/10/29	medium
343660	EulerOS 2.0 SP12 : expat (EulerOS-SA-2026-3333)	Nessus	Huawei Local Security Checks	2026/9/8	2026/10/26	medium
364081	EulerOS 2.0 SP15 : expat (EulerOS-SA-2026-3974)	Nessus	Huawei Local Security Checks	2026/10/8	2026/10/26	medium
364972	EulerOS 2.0 SP11 : expat (EulerOS-SA-2026-4316)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/26	high
370428	openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:22139-1)	Nessus	SuSE Local Security Checks	2026/10/22	2026/10/23	high
371085	SUSE SLES16: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:24260-1)	Nessus	SuSE Local Security Checks	2026/10/23	2026/10/23	high
371091	SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4834-1)	Nessus	SuSE Local Security Checks	2026/10/23	2026/10/23	high

检测

插件搜索

medium

medium

medium

high

high

high

high