Skip to content
OpenAdvisories
High ELSA-2025-8465 2 CVEs

Important: firefox security update (Oracle Linux 7)

Published Jun 6, 2025 · Updated Jun 6, 2025

Summary

[128.10.1-1.0.1]
- Update to 128.10.1 [Orabug: 38028280][CVE-2025-4918][CVE-2025-4919]

[128.10.0-1.0.1]
- Updated to 128.10.0 build [Orabug: 37924620]
- Fixes CVE-2025-2817 CVE-2025-4083 CVE-2025-4087 CVE-2025-4091 and
- CVE-2025-4093

[128.9.0-2.0.1]
- Update to 128.9.0 build2 [Orabug: 37796786][CVE-2025-3028][CVE-2025-3029]
[CVE-2025-3030]

[128.8.0-1.0.1]
- Update to 128.8.0 build1 [Orabug: 37700882][CVE-2025-1930][CVE-2025-1931]
[CVE-2025-1932][CVE-2025-1933][CVE-2025-1934][CVE-2025-1935][CVE-2025-1936]
[CVE-2025-1937][CVE-2025-1938]

[128.7.0-1.0.1]
- Update to 128.7.0 build1 [Orabug: 37564202][CVE-2025-1009][CVE-2025-1010]
[CVE-2025-1011][CVE-2025-1012][CVE-2025-1013][CVE-2025-1014][CVE-2025-1016]
[CVE-2025-1017]

[128.6.0-1.0.1]
- Update to 128.6.0 build1 [Orabug: 37460830][CVE-2025-0237][CVE-2025-0238]
[CVE-2025-0239][CVE-2025-0240][CVE-2025-0241][CVE-2025-0242][CVE-2025-0243]
- Enable PipeWire camera support for RHEL 10
+ backport upstream fixes for PipeWire camera support
Fixes: RHEL-64749

[128.5.1-1.0.1]
- Update to 128.5.1 [Orabug: 37370369][CVE-2024-11692][CVE-2024-11694]
[CVE-2024-11695][CVE-2024-11696][CVE-2024-11697][CVE-2024-11699]

[128.4.0-1.0.1]
- Update to 128.4.0 build1 [Orabug: 37236498][CVE-2024-10458][CVE-2024-10459]
[CVE-2024-10460][CVE-2024-10461][CVE-2024-10462][CVE-2024-10463]
[CVE-2024-10464][CVE-2024-10465][CVE-2024-10466][CVE-2024-10467]

[128.3.1-2.0.1]
- Update to 128.3.1 [Orabug: 37168934]

[128.3.0-1.0.1]
- Update to 128.3.0 [Orabug: 37139909]

[128.2.0-1.0.1]
- Remove nomerge annotation from abort calls [Orabug: 37079143]
- Update to 128.2.0 [Orabug: 37079143]

[115.12.0-1.0.3]
- Security fixes [Orabug: 36904311][Orabug: 36948200][CVE-2024-6601]
[CVE-2024-6603][CVE-2024-6604][CVE-2024-7519][CVE-2024-7520][CVE-2024-7521]
[CVE-2024-7522][CVE-2024-7524][CVE-2024-7525][CVE-2024-7526][CVE-2024-7527]
[CVE-2024-7529]

[115.12.0-1.0.1]
- Remove upstream references [Orabug: 30143292]
- Update distribution for Oracle Linux [Orabug: 30143292]
- Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file

[115.12.0-1]
- Update to 115.12.0 build1

[115.11.0-1]
- Update to 115.11.0 build1

[115.10.0-1]
- Update to 115.10.0 build1

[115.9.1-2]
- Removed expat CVE fix

[115.9.1-1]
- Update to 115.9.1

[115.9.0-2]
- Update to 115.9.0 build2

[115.9.0-1]
- Update to 115.9.0 build1
- Fix expat CVE-2023-52425

[115.8.0-1]
- Update to 115.8.0 build1

[115.7.0-1]
- Update to 115.7.0 build1

[115.6.0-1]
- Update to 115.6.0 build1

[115.5.0-1]
- Update to 115.5.0 build1

[115.4.0-1]
- Update to 115.4.0 build1
- Add fix for CVE-2023-44488
- Set homepage from os-release HOME_URL

[115.3.1-1]
- Update to 115.3.1

[115.3.0-1]
- Update to 115.3.0 ESR

[115.2.0-3]
- Update to 115.2.0 ESR

[115.1.0-1]
- Update to 115.1.0 ESR

[115.0.2-1]
- Update to 115.0.2 ESR

[115.0b8-1]
- Update to 115.0b8

[102.11.0-2]
- Update to 102.11.0 build2

[102.11.0-1]
- Update to 102.11.0 build1

[102.10.0-1]
- Update to 102.10.0 build1

[102.9.0-4]
- Update to 102.9.0 build2

[102.9.0-2]
- removed disable-openh264-download

[102.9.0-1]
- Update to 102.9.0 build1

[102.8.0-2]
- Update to 102.8.0 build2

[102.8.0-1]
- Update to 102.8.0 build1

[102.7.0-1]
- Update to 102.7.0 build1

[102.6.0-2]
- Add firefox-x11 subpackage to allow explicit run of firefox under x11 on RHEL9

[102.6.0-1]
- Update to 102.6.0 build1

[102.5.0-2]
- Added libwebrtc screencast patch for newer features

[102.5.0-1]
- Update to 102.5.0 build1

[102.4.0-1]
- Update to 102.4.0 build1

[102.3.0-7]
- Fix for expat CVE-2022-40674 and non functional webrtc

[102.3.0-6]
- Update to 102.3.0 build1

[91.12.0-1]
- Update to 91.12.0 build1

[91.11.0-2]
- Update to 91.11.0 build2

[91.11.0-1]
- Update to 91.11.0 build1

[91.10.0-1]
- Update to 91.10.0 build1

[91.9.1-1]
- Update to 91.9.1 build1

[91.9.0-1]
- Update to 91.9.0

[91.8.0-1]
- Update to 91.8.0

[91.7.0-3]
- Update to 91.7.0 build3

[91.7.0-2]
- Added expat backports of CVE-2022-25235, CVE-2022-25236 and CVE-2022-25315

[91.7.0-1]
- Update to 91.7.0 build2

[91.6.0-2]
- Install langpacks to the browser/extensions to make them available in UI:
rhbz#2030190

[91.6.0-1]
- Update to 91.6.0 build1

[91.5.0-2]
- Use default update channel to fix non working enterprise policies:
rhbz#2044667

[91.5.0-1]
- Update to 91.5.0 build1

[91.4.0-2]
- Added fix for failing addons signatures.

[91.4.0-1]
- Update to 91.4.0 build1

[91.3.0-1]
- Update to 91.3.0 build1

[91.2.0-5]
- Fixed crashes when FIPS is enabled.

[91.2.0-4]
- Disable webrender on the s390x due to wrong colors: rhbz#2009503

[91.2.0-3]
- Update to 91.2.0 build1

[91.1.0-1]
- Update to 91.1.0 build1

* Tue Aug 17 2021 Jan Horak <jhorak@redhat.com>
- Update to 91.0.1 build1

[91.0-1]
- Update to 91.0 ESR

[91.0-1]
- Update to 91.0b8

[78.12.0-2]
- Rebuild to pickup older nss

[78.12.0-1]
- Update to 78.12.0 build1

[78.11.0-3]
- Update to 78.11.0 build2 (release)

[78.11.0-2]
- Fix rhel_minor_version for dist .el8_4 and .el8

[78.11.0-1]
- Update to 78.11.0 build1

[78.10.0-1]
- Update to 78.10.0

[78.9.0-1]
- Update to 78.9.0 build1

[78.8.0-1]
- Update to 78.8.0 build2

[78.7.1-1]
- Update to 78.7.1

[78.7.0-3]
- Fixing install prefix for the homepage

[78.7.0-2]
- Update to 78.7.0 build2

[78.7.0-1]
- Update to 78.7.0 build1

[78.6.1-1]
- Update to 78.6.1 build1

[78.6.0-1]
- Update to 78.6.0 build1

[78.5.0-1]
- Update to 78.5.0 build1

* Tue Nov 10 2020 erack@redhat.com - 78.4.1-1
- Update to 78.4.1

[78.4.0-3]
- Fixing flatpak build, fixing firefox.sh.in to not disable langpacks loading

[78.4.0-2]
- Enable addon sideloading

[78.4.0-1]
- Update to 78.4.0 build2

* Fri Sep 18 2020 Jan Horak <jhorak@redhat.com>
- Update to 78.3.0 build1

[78.2.0-3]
- Update to 78.2.0 build1

* Fri Jul 24 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.11.0 build1

* Fri Jun 26 2020 Jan Horak <jhorak@redhat.com>
- Update to 68.10.0 build1

* Fri May 29 2020 Jan Horak <jhorak@redhat.com>
- Update to 68

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 firefox 0:128.10.1-1.0.1.el7_9

Vulnerabilities 2

  • Critical 9.8

    Out-of-bounds access when resolving Promise objects

    An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.

  • High 8.8

    Out-of-bounds access when optimizing linear sums

    An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.