Mozilla Firefox and Mozilla Firefox ESR security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is an extended support version of Firefox web browser. A spoofing vulnerability exists in several Mozilla products and is caused due to an error in the address bar component. An attacker coul...

Security Vulnerabilities fixed in Firefox ESR 140.2 — Mozilla

An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. Same-origin policy bypass in the Graphics: Canvas2D component. Uninitialized memory ...

Security Vulnerabilities fixed in Focus for iOS 142 — Mozilla

Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS attacks Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in XSS...

CVE-2025-9183: User Interface (UI) Misrepresentation of Critical Information

Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 142 and Firefox ESR 140.2...

PT-2025-33877 · Mozilla · Focus For Ios

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 14.2 Description: Dragging JavaScript links to the URL bar in Focus for iOS could be utilized to run malicious scripts, potentially resulting in cross-site scripting XSS attacks. Recommendations: Update Focus f...

CVE-2025-8041: User Interface (UI) Misrepresentation of Critical Information

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141...

CVE-2025-9186: User Interface (UI) Misrepresentation of Critical Information

Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142...

PT-2025-33872

Name of the Vulnerable Software and Affected Versions: Firefox Focus versions prior to 142 Description: A spoofing issue exists in the Address Bar component of Firefox Focus for Android. Recommendations: Update Firefox Focus to version 142 or later...

KLA86791 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, cause denial of service, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Uninitialized memory vulnerability in t...

KLA86790 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service, spoof user interface. Below is a complete list of vulnerabilities: 1. Memory corruption vulnerability in...

[SECURITY] [DSA 5978-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5978-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 18, 2025 https://www.debian.org/security/faq -...

SUSE-SU-2025:02777-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

SUSE SLES15: libjavascriptcoregtk-4_0-18 / libwebkit2gtk-4_0-37 / etc (SUSE-SU-2025:02766-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02766-1 advisory. Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to...

SUSE SLED15: WebKitGTK-4.0-lang / WebKitGTK-4.1-lang / WebKitGTK-6.0-lang / etc (SUSE-SU-2025:02765-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02765-1 advisory. Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

SUSE-SU-2025:02765-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Updated to version 2.48.5: - CVE-2025-31273: Fixed a vulnerability where processing maliciously crafted web content could lead to memory corruption. bsc1247564 - CVE-2025-31278: Fixed a vulnerability where processing maliciously crafted web...

Linux Distros Unpatched Vulnerability : CVE-2025-8039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability was fixed in Firefox 141, Firefox ESR...

Linux Distros Unpatched Vulnerability : CVE-2019-11695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the...

Linux Distros Unpatched Vulnerability : CVE-2024-5698

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - By manipulating the fullscreen feature while opening a data-list, an attacker could have overlaid a text box over the address bar. This could have led to user...