Red Hat Security AdvisoryRHSA-2025:0080
firefox security update
Released 2025-01-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) firefox-128.6.0-1.el9_5, firefox-x11-128.6.0-1.el9_5
Fixes 7 records
Priority MEDIUM 46
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.14716 · Published 2025-01-07 · Partial fix · 115.19, 128.6 +1 CWE-787
Priority MEDIUM 43
When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash.
CVSS 3.1HIGH 7.7· Network · No auth · No interaction · EPSS 0.00734 · Published 2025-01-07 · Partial fix · 128.6, 134 CWE-401
Priority LOW 27
The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00598 · Published 2025-01-07 · Partial fix · 128.6, 134 CWE-863
Priority LOW 25
Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5.
CVSS 3.1MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.0025 · Published 2025-01-07 · Partial fix · 128.6, 134 CWE-787
Priority LOW 25
Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00794 · Published 2025-01-07 · Partial fix · 115.19, 128.6 +1 CWE-416
Priority LOW 20
Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free.
CVSS 3.1MEDIUM 4.0· Local · No auth · No interaction · EPSS 0.00673 · Published 2025-01-07 · Partial fix · 128.6, 134 CWE-416
Priority LOW 18
When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site.
CVSS 3.1MEDIUM 4.0· Local · No auth · No interaction · EPSS 0.00227 · Published 2025-01-07 · Partial fix · 128.6, 134 CWE-295
THREATIST.IORead the docs