UBUNTU-CVE-2025-6433

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This...

UBUNTU-CVE-2025-6427

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6436

Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6433

If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would be prompted to complete. This is in violation of the WebAuthN spec which requires "a secure transport established without errors". This...

CVE-2025-6431 The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects...

CVE-2025-6431

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. This bug only affects...

CVE-2025-6428

When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. This bug only affects Firefox for Android. Other versions of Firefox are unaffected.. This vulnerability was fixed in Firefox 140...

CVE-2025-6427

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

CVE-2025-6430

When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a embed or object tag, potentially making a website vulnerable to a cross-site scripting attack. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12,...

CVE-2025-6426

The executable file warning did not warn users before opening files with the terminal extension. This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12...

CVE-2025-6429

Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox E...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 140, which stems from allowing WebAuthn challenges despite invalid TLS certificates, which could lead to security risks...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 140, which stems from a memory security issue that could lead to memory corruption and the execution of arbitrary code...

PT-2025-26724

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 140 Description: An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments, which would have also hidden the connections from the Network tab in Devtools...

Astra Linux – Vulnerability in Firefox

An attacker was able to bypass the connect-src directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connections from the Network tab in Devtools. This vulnerability was fixed in Firefox 140 and Thunderbird 140...

Astra Linux – Vulnerability in Firefox

Memory safety bugs exist in Firefox 139 and Thunderbird 139. Some of these bugs exhibited signs of memory corruption, and we assume that with sufficient effort, some of these bugs could have been exploited to execute arbitrary code. This vulnerability has been fixed in Firefox 140 and Thunderbird...

Slackware: Security Advisory (SSA:2025-140-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the microprogramming software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 lies in the possibility of operations being executed outside the buffer in memory, which can allow a hacker to cause a service failure.

The vulnerability of the microprogrammed graphics processor software of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of Microprogrammed Graphics Processor Software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170, related to access control deficiencies, allows attackers to trigger service failures.

The vulnerability of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 graphics processors is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to cause service failures...

The vulnerability of Microprogrammed Graphics Processor Software for Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170, related to access control deficiencies, allows attackers to trigger service failures.

The vulnerability of Intel Data Center GPU Flex 140 and Intel Data Center GPU Flex 170 graphics processors is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to cause service failures...