Skip to content
OpenAdvisories
Critical RHSA-2025:8640 2 CVEs

Red Hat Security Advisory: firefox security update

Published Jun 9, 2025 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream firefox 0:128.10.1-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream firefox-debuginfo 0:128.10.1-1.el8_4
Red Hat · RHEL 8.4 AUS rhel_aus:8.4::appstream firefox-debugsource 0:128.10.1-1.el8_4

Vulnerabilities 2

  • Critical 9.8
    CVE-2025-4918

    Out-of-bounds access when resolving Promise objects

    An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi
  • High 8.8
    CVE-2025-4919

    Out-of-bounds access when optimizing linear sums

    An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2367016
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2367018
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8640.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-4918
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-4918
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-4918
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-37/#CVE-2025-4918
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-40/#CVE-2025-4918
  • report
    https://access.redhat.com/security/cve/CVE-2025-4919
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-4919
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-4919
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-37/#CVE-2025-4919
  • article
    https://www.mozilla.org/en-US/security/advisories/mfsa2025-40/#CVE-2025-4919