Most recent entries from all

ALSA-2025:18154 — Important: firefox security update

2026-10-04T12:11:07.684762+00:00

Affected: AlmaLinux:10: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714) * thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709) * thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710) * thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708) * thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712) * thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715) * thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-13289

2026-10-04T12:11:07.684841+00:00

bdu:2025-13289

certfr-2025-avi-0873 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

2026-10-04T12:11:07.684858+00:00

certfr-2025-avi-0873

cnvd-2025-24622

2026-10-04T12:11:07.684875+00:00

cnvd-2025-24622

EUVD-2026-290760

2026-10-04T12:11:07.684886+00:00

EUVD-2026-290760

fkie_cve-2025-11708

2026-10-04T12:11:07.684896+00:00

Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

GHSA-h7jc-cc8w-wcwg

2026-10-04T12:11:07.684918+00:00

Use-after-free in MediaTrackGraphImpl::GetInstance() This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.

OESA-2025-2476 — firefox security update

2026-10-04T12:11:07.684933+00:00

Affected: openEuler:24.03-LTS-SP1: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global moz_debug_prefix /lib/debug %global moz_debug_dir /lib/debug/ %global uname_m %(uname -m) %global symbols_file_name -.en-US.-%(uname.crashreporter-symbols.zip %global symbols_file_path /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip %global _find_debuginfo_opts -p /lib/debug//-.en-US.-%(uname.crashreporter-symbols.zip -o debugcrashreporter.list %global crashreporter_pkg_name mozilla-crashreporter--debuginfo Security Fix(es):

Use-after-free vulnerability in MediaTrackGraphImpl::GetInstance(). This vulnerability affects Firefox < 144, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.(CVE-2025-11708)

A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.(CVE-2025-11709)

A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability affects Firefox < 144, Firefox ESR < 115.29, Firefox ESR < 140.4, Thunderbird < 144, and Thunderbird < 140.4.(CVE-2025-11710)

There was a way to change the value of JavaScript Object properties that were supposed to be non-writeabl…

openSUSE-SU-2025:15632-1 — firefox-esr-140.4.0-1.1 on GA media

2026-10-04T12:11:07.684977+00:00

firefox-esr-140.4.0-1.1 on GA media

RHSA-2025:18154 — Red Hat Security Advisory: firefox security update

2026-10-04T12:11:07.684998+00:00

thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures thunderbird: firefox: Cross-process information leaked due to malicious IPC messages thunderbird: firefox: Some non-writable Object properties could be modified thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type thunderbird: firefox: Memory safety bugs thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144

SUSE-SU-2025:21021-1 — Security update for MozillaFirefox

2026-10-04T12:11:07.685025+00:00

Security update for MozillaFirefox

UBUNTU-CVE-2025-11708

2026-10-04T12:11:07.685051+00:00

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

WID-SEC-W-2025-2275 — Mozilla Firefox: Mehrere Schwachstellen

2026-10-04T12:11:07.685083+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um Code ausführen, privilegierte Informationen auslesen, Sicherheitsmechanismen umgehen oder Benutzer durch UI-Manipulation täuschen.