Red Hat Security Advisory: firefox security update

Fixed packages 9

Vulnerabilities 8

• High 8.8
  CVE-2025-10533

  Integer overflow in the SVG component

  Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 8.8
  CVE-2025-10537

  Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143

  Memory safety bugs present in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary co…

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 7.3
  CVE-2025-10528

  Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component

  Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• High 7.1
  CVE-2025-10527

  Sandbox escape due to use-after-free in the Graphics: Canvas2D component

  Sandbox escape due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.5
  CVE-2025-10529

  Same-origin policy bypass in the Layout component

  Same-origin policy bypass in the Layout component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.5
  CVE-2025-10532

  Incorrect boundary conditions in the JavaScript: GC component

  Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 6.2
  CVE-2025-10536

  Information disclosure in the Networking: Cache component

  Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

  Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  Sep 16, 2025
• Medium 5.1
  CVE-2024-12224

  idna accepts Punycode labels that do not produce any non-ASCII when decoded

  Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to anoth…

  servo rust-url linkerd2-controller linkerd2-tap Debian Ubuntu Alpine Wolfi crates.io
  May 30, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395745
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395754
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395755
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395756
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395759
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395764
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2395766
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_17367.json
• report
  https://access.redhat.com/security/cve/CVE-2024-12224
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2369303
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-12224
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-12224
• article
  https://bugzilla.mozilla.org/show_bug.cgi?id=1887898
• article
  https://rustsec.org/advisories/RUSTSEC-2024-0421.html
• report
  https://access.redhat.com/security/cve/CVE-2025-10527
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10527
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10527
• article
  https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10527
• article
  https://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10527
• report
  https://access.redhat.com/security/cve/CVE-2025-10528
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10528
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10528
• article
  https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10528
• article
  https://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10528
• report
  https://access.redhat.com/security/cve/CVE-2025-10529
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10529
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10529
• article
  https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10529
• article
  https://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10529
• report
  https://access.redhat.com/security/cve/CVE-2025-10532
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10532
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10532
• article
  https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10532
• article
  https://www.mozilla.org/security/advisories/mfsa2025-78/#CVE-2025-10532
• report
  https://access.redhat.com/security/cve/CVE-2025-10533
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-10533
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-10533
• article
  https://www.mozilla.org/security/advisories/mfsa2025-75/#CVE-2025-10533