When checking if the Browsing Context had been discarded in `HttpBaseChannel`, if the load group was not available then it was assumed to have already been discarded which was not always the case for private channels after the private session had ended. This vulnerability affects Firefox < 117, Firefox ESR < 115.2, and Thunderbird < 115.2.

...

During garbage collection extra operations were performed on a object that should not be. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.

...

If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 124, Firefox ESR < 115.9, and Thunderbird < 115.9.

...

Linux Distros Unpatched Vulnerability : CVE-2025-9181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142,...

The vulnerability in Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird arises from performing operations beyond the buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerabilities of Mozilla Firefox, Mozilla Firefox ESR, and the email client Mozilla Thunderbird are related to the execution of operations beyond the buffer boundaries in memory. Exploiting these vulnerabilities allows a remote attacker to execute arbitrary code...

The vulnerability of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, related to an unvalidated return value, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to unvalidated return values. Exploiting these vulnerabilities can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information...

SUSE-SU-2025:03008-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: - Firefox Extended Support Release 140.2.0 ESR MFSA 2025-67 bsc1248162 CVE-2025-9179 bmo1979527: Sandbox escape due to invalid pointer in the Audio/Video: GMP component CVE-2025-9180 bmo1979782: Same-origin policy bypass in the Graphics:...

ROS-20250827-08

Vulnerability in Mozilla Firefox, Firefox ESR and Thunderbird email client is related to an operation exceeding the memory buffer boundaries. operation outside of the memory buffer. Exploitation of the vulnerability could allow an attacker acting remotely to affect the confidentiality, integrity,...

The vulnerability in the JavaScript Engine component of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the JavaScript Engine component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird relates to access to an uninitialized pointer. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of...

thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs are present in the following versions: Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, a...

Linux Distros Unpatched Vulnerability : CVE-2024-2610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Using a markup injection an attacker could have stolen nonce values. This could have been used to bypass strict content security policies. This vulnerability...

CVE-2025-9182 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

GHSA-7379-6RF2-Q4F9 vulnerabilities

Vulnerabilities for packages: firefox, firefox-esr...

Debian: Security Advisory (DLA-4277-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

firefox-esr-140.2.0-1.1 on GA media (moderate)

firefox-esr-140.2.0-1.1 on GA media Announcement ID: openSUSE-SU-2025:15468-1 Rating: moderate Cross-References: CVE-2025-9179 CVE-2025-9180 CVE-2025-9181 CVE-2025-9182 CVE-2025-9183 CVE-2025-9184 CVE-2025-9185 CVSS scores: CVE-2025-9180 SUSE : 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N...

Mozilla Thunderbird ESR Security Update (mfsa_2025-72) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Thunderbird ESR Security Update (mfsa_2025-72) - Mac OS X

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Firefox ESR Security Update (mfsa_2025-65) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Debian dla-4277 : firefox-esr - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4277 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4277-1 [email protected]...

SUSE CVE-2025-9179

An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14,...