Most recent entries from all

ALSA-2025:8293 — Important: firefox security update

Affected: AlmaLinux:9: firefox, AlmaLinux:9: firefox-x11

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267) * firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264) * firefox: thunderbird: Memory safety bugs (CVE-2025-5268) * firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266) * firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263) * firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-06225

certfr-2025-avi-0454 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta…

certfr-2025-avi-0454

EUVD-2026-290749

fkie_cve-2025-5268

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11.

GHSA-m885-h2wc-h2w3

OESA-2025-1633 — firefox security update

Affected: openEuler:24.03-LTS-SP1: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fix(es):

Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5263)

Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system. This vulnerability affects Firefox < 139, Firefox ESR < 115.24, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5264)

Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5266)

A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability affects Firefox < 139, Firefox ESR < 128.11, Thunderbird < 139, and Thunderbird < 128.11.(CVE-2025-5267)

Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we…

openSUSE-SU-2025:15170-1 — firefox-esr-128.11.0-1.1 on GA media

firefox-esr-128.11.0-1.1 on GA media

RHSA-2025:8341 — Red Hat Security Advisory: firefox security update

firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content firefox: thunderbird: Potential local code execution in “Copy as cURL” command firefox: thunderbird: Script element events leaked cross-origin resource status firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details firefox: thunderbird: Memory safety bugs firefox: thunderbird: Memory safety bug libvpx: Double-free in libvpx encoder

SUSE-SU-2025:01769-1 — Security update for MozillaFirefox

Security update for MozillaFirefox

UBUNTU-CVE-2025-5268

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

WID-SEC-W-2025-1160 — Mozilla Firefox und Thunderbird: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service auszulösen, Sicherheitsvorkehrungen zu umgehen oder Informationen offenzulegen.