diff -Nru firefox-93.0+build1/debian/changelog firefox-93.0+build1/debian/changelog
--- firefox-93.0+build1/debian/changelog	2021-09-28 10:04:51.000000000 +0000
+++ firefox-93.0+build1/debian/changelog	2021-10-06 15:40:06.000000000 +0000
@@ -1,3 +1,11 @@
+firefox (93.0+build1-0ubuntu3) impish; urgency=medium
+
+  * Cherry-pick an upstream patch to fix Widevine CDM crashes on impish
+    (LP: #1945100)
+    - debian/patches/upstream-49bf466c3f24.patch
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Wed, 06 Oct 2021 17:40:06 +0200
+
 firefox (93.0+build1-0ubuntu2) impish; urgency=medium
 
   * Update test expectation (https://bugzilla.mozilla.org/1283388)
diff -Nru firefox-93.0+build1/debian/patches/series firefox-93.0+build1/debian/patches/series
--- firefox-93.0+build1/debian/patches/series	2021-08-31 07:12:55.000000000 +0000
+++ firefox-93.0+build1/debian/patches/series	2021-10-06 15:39:42.000000000 +0000
@@ -13,3 +13,4 @@
 ppc64el-workaround-bug-1555531.patch
 armhf-clang-no-integrated-as-for-neon.patch
 armhf-do-not-build-qcms-with-neon.patch
+upstream-49bf466c3f24.patch
diff -Nru firefox-93.0+build1/debian/patches/upstream-49bf466c3f24.patch firefox-93.0+build1/debian/patches/upstream-49bf466c3f24.patch
--- firefox-93.0+build1/debian/patches/upstream-49bf466c3f24.patch	1970-01-01 00:00:00.000000000 +0000
+++ firefox-93.0+build1/debian/patches/upstream-49bf466c3f24.patch	2021-10-06 15:39:23.000000000 +0000
@@ -0,0 +1,92 @@
+
+# HG changeset patch
+# User Jed Davis <jld@mozilla.com>
+# Date 1631311879 0
+# Node ID 49bf466c3f24a48410e81d4e8ba29c9fd39ed96b
+# Parent  792f25f1405d53a0a3e707a850e67c8714989327
+Bug 1725828 - Preload dependencies for the Widevine CDM when sandboxing it on Linux. r=bryce
+
+Differential Revision: https://phabricator.services.mozilla.com/D123542
+
+diff --git a/dom/media/gmp/GMPChild.cpp b/dom/media/gmp/GMPChild.cpp
+--- a/dom/media/gmp/GMPChild.cpp
++++ b/dom/media/gmp/GMPChild.cpp
+@@ -227,18 +227,24 @@ mozilla::ipc::IPCResult GMPChild::RecvPr
+               .EqualsASCII(lib.Data(), lib.Length())) {
+         LoadLibraryW(char16ptr_t(whiteListedLib));
+         break;
+       }
+     }
+   }
+ #elif defined(XP_LINUX)
+   constexpr static const char* whitelist[] = {
++      // NSS libraries used by clearkey.
+       "libfreeblpriv3.so",
+       "libsoftokn3.so",
++      // glibc libraries merged into libc.so.6; see bug 1725828 and
++      // the corresponding code in GMPParent.cpp.
++      "libdl.so.2",
++      "libpthread.so.0",
++      "librt.so.1",
+   };
+ 
+   nsTArray<nsCString> libs;
+   SplitAt(", ", aLibs, libs);
+   for (const nsCString& lib : libs) {
+     for (const char* whiteListedLib : whitelist) {
+       if (lib.EqualsASCII(whiteListedLib)) {
+         auto libHandle = dlopen(whiteListedLib, RTLD_NOW | RTLD_GLOBAL);
+@@ -251,17 +257,17 @@ mozilla::ipc::IPCResult GMPChild::RecvPr
+           if (error) {
+             // We should always have an error, but gracefully handle just in
+             // case.
+             nsAutoCString nsError{error};
+             CrashReporter::AppendAppNotesToCrashReport(nsError);
+           }
+           // End bug 1698718 logging.
+ 
+-          MOZ_CRASH("Couldn't load lib needed by NSS");
++          MOZ_CRASH("Couldn't load lib needed by media plugin");
+         }
+       }
+     }
+   }
+ #endif
+   return IPC_OK();
+ }
+ 
+diff --git a/dom/media/gmp/GMPParent.cpp b/dom/media/gmp/GMPParent.cpp
+--- a/dom/media/gmp/GMPParent.cpp
++++ b/dom/media/gmp/GMPParent.cpp
+@@ -871,16 +871,30 @@ RefPtr<GenericPromise> GMPParent::ParseC
+     mLibs = "dxva2.dll"_ns;
+ #endif
+   } else {
+     GMP_PARENT_LOG_DEBUG("%s: Unrecognized key system: %s, failing.",
+                          __FUNCTION__, mDisplayName.get());
+     return GenericPromise::CreateAndReject(NS_ERROR_FAILURE, __func__);
+   }
+ 
++#ifdef XP_LINUX
++  // These glibc libraries were merged into libc.so.6 as of glibc
++  // 2.34; they now exist only as stub libraries for compatibility and
++  // newly linked code won't depend on them, so we need to ensure
++  // they're loaded for plugins that may have been linked against a
++  // different version of glibc.  (See also bug 1725828.)
++  if (!mDisplayName.EqualsASCII("clearkey")) {
++    if (!mLibs.IsEmpty()) {
++      mLibs.AppendLiteral(", ");
++    }
++    mLibs.AppendLiteral("libdl.so.2, libpthread.so.0, librt.so.1");
++  }
++#endif
++
+   nsCString codecsString = NS_ConvertUTF16toUTF8(m.mX_cdm_codecs);
+   nsTArray<nsCString> codecs;
+   SplitAt(",", codecsString, codecs);
+ 
+   // Parse the codec strings in the manifest and map them to strings used
+   // internally by Gecko for capability recognition.
+   //
+   // Google's code to parse manifests can be used as a reference for strings
+