Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-6430: When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a <embed> or <object> tag, potentially making a website vulnerable to a cross-site scripting attack. CVE-2025-6429: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability affects Firefox < 140 and Firefox ESR < 128.12. CVE-2025-6425: An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12. CVE-2025-6424: A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability affects Firefox < 140, Firefox ESR < 115.25, and Firefox ESR < 128.12.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | firefox | 0:128.12.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | firefox-debuginfo | 0:128.12.0-1.amzn2023.0.1 |
| Amazon Linux · 2023 | firefox-debugsource | 0:128.12.0-1.amzn2023.0.1 |
Vulnerabilities 4
-
Critical 9.8
Use-after-free in FontFaceSet
A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
-
Medium 6.5
Incorrect parsing of URLs could have allowed embedding of youtube.com
Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerabi…
-
Medium 6.1
Content-Disposition header ignored when a file is included in an embed or object tag
When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<object>` tag, potentially making a website vulnerable to a cross-site scripting attack. This vuln…
-
Medium 4.3
The WebCompat WebExtension shipped with Firefox exposed a persistent UUID
An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 1…