Most recent entries from all

ALSA-2025:2359 — Important: firefox security update

Affected: AlmaLinux:9: firefox, AlmaLinux:9: firefox-x11

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Use-after-free in WebTransportChild (CVE-2025-1931) * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930) * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934) * firefox: Clickjacking the registerProtocolHandler info-bar Reporter (CVE-2025-1935) * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1938) * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933) * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937) * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932) * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents (CVE-2025-1936)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-02599

certfr-2025-avi-0176 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2025-avi-0176

EUVD-2026-324631

fkie_cve-2025-1930

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

GHSA-5289-2q6r-6q3g

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, and Firefox ESR < 128.8.

OESA-2025-1835 — thunderbird security update

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

openSUSE-SU-2025:14852-1 — firefox-esr-128.8.0-1.1 on GA media

firefox-esr-128.8.0-1.1 on GA media

RHSA-2025:2479 — Red Hat Security Advisory: firefox security update

firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process firefox: Use-after-free in WebTransportChild firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access firefox: JIT corruption of WASM i32 return values on 64-bit CPUs firefox: Unexpected GC during RegExp bailout processing firefox: Clickjacking the registerProtocolHandler info-bar Reporter firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

SUSE-SU-2025:0783-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2025-1930

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

WID-SEC-W-2025-0482 — Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, erhöhte Privilegien zu erlangen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, beliebigen Code auszuführen oder nicht spezifizierte Auswirkungen zu verursachen.