Skip to content
OpenAdvisories
High ALSA-2025:18155 7 CVEs

Important: firefox security update

Published Oct 15, 2025 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)
* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)
* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)
* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)
* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)
* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)
* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 9 firefox 140.4.0-3.el9_6.alma.1
AlmaLinux · 9 firefox-x11 140.4.0-3.el9_6.alma.1

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-11708

    Use-after-free in MediaTrackGraphImpl::GetInstance()

    Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-11709

    Out of bounds read/write in a privileged process triggered by WebGL textures

    A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 14…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Critical 9.8
    CVE-2025-11710

    Cross-process information leaked due to malicious IPC messages

    A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird …

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2025-11714

    Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144

    Memory safety bugs present in Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2025-11715

    Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144

    Memory safety bugs present in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 6.5
    CVE-2025-11711

    Some non-writable Object properties could be modified

    There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • Medium 6.1
    CVE-2025-11712

    An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

    A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This could have contributed to an XSS on a site that unsafely serves files without a …

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-11708
  • report
    https://access.redhat.com/security/cve/CVE-2025-11709
  • report
    https://access.redhat.com/security/cve/CVE-2025-11710
  • report
    https://access.redhat.com/security/cve/CVE-2025-11711
  • report
    https://access.redhat.com/security/cve/CVE-2025-11712
  • report
    https://access.redhat.com/security/cve/CVE-2025-11714
  • report
    https://access.redhat.com/security/cve/CVE-2025-11715
  • report
    https://bugzilla.redhat.com/2403763
  • report
    https://bugzilla.redhat.com/2403765
  • report
    https://bugzilla.redhat.com/2403768
  • report
    https://bugzilla.redhat.com/2403769
  • report
    https://bugzilla.redhat.com/2403770
  • report
    https://bugzilla.redhat.com/2403774
  • report
    https://bugzilla.redhat.com/2403776
  • advisory
    https://errata.almalinux.org/9/ALSA-2025-18155.html