Read the docs
Red Hat Security Advisory

RHSA-2025:1137

firefox security update

Released 2025-02-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 8 records

TI-2025-00851 CVE-2025-1009 · GHSA-v9m4-7h7v-vqrf

Use-after-free in XSLT

Priority HIGH 82

An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01207 Published 2025-02-04 Partial fix · 115.20, 128.7 +1 CWE-416
TI-2025-00854 CVE-2025-1012 · GHSA-hjjx-mmjm-vp9r

Use-after-free during concurrent delazification

Priority MEDIUM 49

A race during concurrent delazification could have led to a use-after-free.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00452 Published 2025-02-04 Partial fix · 115.20, 128.7 +1 CWE-416
TI-2025-00852 CVE-2025-1010 · GHSA-f666-246m-p7mg

Use-after-free in Custom Highlight

Priority MEDIUM 49

An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00464 Published 2025-02-04 Partial fix · 115.20, 128.7 +1 CWE-416
TI-2025-00858 CVE-2025-1016 · GHSA-mh3f-c34v-4q6q

Out-of-bounds write in Mozilla Firefox

Priority MEDIUM 43

Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00592 Published 2025-02-04 Partial fix · 115.20, 128.7 +1 CWE-787
TI-2025-00856 CVE-2025-1014 · GHSA-v2xc-3r7v-9vrm

Improper certificate validation in Mozilla Firefox

Priority LOW 38

Certificate length was not properly checked when added to a certificate store.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0039 Published 2025-02-04 Partial fix · 128.7, 135 CWE-295